{"id":"CVE-2026-111687","title":"WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint","summary":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ex…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-95"],"vendor":"rachelos","product":"we-mp-rss","affected":["we-mp-rss <= 1.5.3"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:04:57.256748Z"},"exploitAvailable":true,"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:43.558Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111687","references":[{"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce"},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166"},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198"},{"url":"https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint","label":"VulnCheck Advisory: WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-16T18:43:08.657Z","slug":"CVE-2026-111687","body":"## Overview\n\nWeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.\n\n## Affected\n\n- `we-mp-rss <= 1.5.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":223354,"id":"CVE-2026-111687","ts":1792180179005,"field":"exploit_available","old":"false","new":"true"}]}