{"action":"Upgrade rsshub to 1.0.0-master.d8ca915 or later.","affected":[{"fixed":"1.0.0-master.d8ca915","introduced":"1.0.0-master.cbbd829"}],"component":"rsshub","cve_ids":["CVE-2024-27926"],"ecosystem":"npm","epss":0.00521,"exploited":false,"fixed_versions":["1.0.0-master.d8ca915"],"ghsa_id":"GHSA-2wqw-hr4f-xrhh","id":"tcs_01M5KEVA0NV20ASHAKW4QZSFKT","modified_at":"2026-09-10T03:50:00.242285502Z","published_at":"2024-03-06T17:02:34Z","references":["https://osv.dev/vulnerability/GHSA-2wqw-hr4f-xrhh","https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh","https://nvd.nist.gov/vuln/detail/CVE-2024-27926","https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87","https://github.com/DIYgod/RSSHub"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2wqw-hr4f-xrhh","url":"https://osv.dev/vulnerability/GHSA-2wqw-hr4f-xrhh"}],"summary":"RSSHub Cross-site Scripting vulnerability caused by internal media proxy"}