{"id":"CVE-2026-111687","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-111687","summary":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id}…","details":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.","published":"2026-10-16T18:17:51.920","modified":"2026-10-16T18:17:51.920","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198"},{"type":"WEB","url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166"},{"type":"WEB","url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-16T18:17:51.920"}}