CVE-2026-111687
Received Received - Intake

Remote Code Execution in WeRSS via Template Injection

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111687
EUVD
EUVD-2026-102978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rachelos we-mp-rss 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WeRSS (we-mp-rss) through version 1.5.3 has a remote code execution flaw. Unauthenticated attackers can execute arbitrary code by manipulating the template parameter in the public GET /rss/{feed_id} endpoint. They can bypass security restrictions by using a non-built-in ext value and a {{=expression}} template that exploits object-subclass traversal to evade the eval denylist, allowing OS command execution as the service account.

Detection Guidance

Check if WeRSS (we-mp-rss) version 1.5.3 or earlier is installed by running commands like 'npm list we-mp-rss' or 'dpkg -l | grep we-mp-rss'. Inspect network traffic for GET requests to /rss/{feed_id} with unusual template parameters containing {{=expression}} or non-built-in ext values.

Impact Analysis

This vulnerability allows attackers to run malicious code on the server hosting WeRSS. This could lead to unauthorized access, data theft, service disruption, or further compromise of the system and network. The impact includes potential loss of sensitive data and operational downtime.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade WeRSS to a version later than 1.5.3 if available. If no patch exists, disable the /rss/{feed_id} endpoint or restrict access via firewall rules. Monitor for suspicious activity in logs, particularly for unauthorized OS command execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart