GHSA-3p3p-cgj7-vgw3 is a medium-severity (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in rsshub. A fix is available for rsshub — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-3p3p-cgj7-vgw3.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
rsshubnpmDescription
Summary
Serveral Server-Side Request Forgery (SSRF) vulnerabilities in RSSHub allow remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks.
Details
/mastodon/acct/:acct/statuses/:only_media?
/zjol/paper/:id?
/m4/:id?/:category*
PoC
- https://rsshub.app/mastodon/acct/[email protected]%23/statuses
- https://rsshub.app/zjol/paper/a6wt15r2.requestrepo.com%23
- https://rsshub.app/m4/a6wt15r2.requestrepo.com%23/test
Impact
The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to:
- Leak the server IP address, which could be hidden behind a CDN.
- Retrieve information in the internal network. e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages.
- DoS amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request:
https://rsshub.a.com/zjol/paper/rsshub.b.net%2Fzjol%2Fpaper%2Frsshub.a.com%252Fzjol%252Fpaper%252Frsshub.b.net%25252Fzjol%25252Fpaper%25252Frsshub.a.com%2525252Fzjol%2525252Fpaper%2525252Fexample.com%2525252523%25252523%252523%2523%23.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | rsshub | all versions | 1.0.0-master.a429472npm install rsshub@1.0.0-master.a429472 |
Affected Products
rsshubrsshubDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rsshub, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update rsshub to 1.0.0-master.a429472 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3p3p-cgj7-vgw3 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Frequently Asked Questions
Is GHSA-3p3p-cgj7-vgw3 in your dependencies?
Find it across npm, including transitive dependencies.