WeRSS (we-mp-rss): Unauthenticated remote code execution via template parameter

Summary

WeRSS (we-mp-rss) through version 1.5.3 allows unauthenticated attackers to execute operating system commands on the server via the template parameter of the public GET /rss/{feed_id} endpoint. The attacker supplies a crafted template expression whose object subclass traversal bypasses the eval denylist, so code runs as the service account. The CVSS 4.0 score is 9.3 (critical), and a public proof of concept is referenced by CISA SSVC data.

Affected

• rachelos we-mp-rss, versions 0 to 1.5.3 (CVE record)
• Docker image ghcr.io/rachelos/we-mp-rss, default port 8001, if it runs an affected version

Fixed in

• Unknown. No upstream fixed version has been confirmed.
• A third-party fork (Aquarius-Situla we-feed, pull request 4) removes the template parameter; this is not a vendor patch.

Workaround

• Do not expose the service directly to the internet; place it behind a VPN or an authenticated reverse proxy.
• Block the template query parameter on the /rss/ path at the reverse proxy or WAF. This is a mitigation, not a verified fix.
• Run the container with least privilege (non-root, read-only filesystem where possible) and keep secrets out of its environment.

Exploitation

• Unauthenticated, network-reachable, low complexity, no user interaction required.
• CISA SSVC (via VulnCheck/Vulnrichment): exploitation status 'poc', automatable: yes.
• Public write-up exists; in-the-wild exploitation is unconfirmed.

Our recommendation

• Inventory all we-mp-rss instances, including forks and Docker images, and check whether any are reachable from the internet.
• Restrict access or take affected instances offline until a fixed upstream version is confirmed.
• Block the template parameter on /rss/ at the reverse proxy as an interim measure.
• Review logs for requests with a template parameter on /rss/ and check the container for unexpected processes or outbound connections.
• Watch the upstream project and the NVD record for a fix and analysis update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Official CVE record references: rss.py at v1.5.3 github.com
• template_parser.py at v1.5.3 github.com
• HackMD write-up: WeRSS RSS template unauthenticated SSTI RCE hackmd.io
• VulnCheck advisory: WeRSS through 1.5.3 RCE via template parameter www.vulncheck.com
• CVE record JSON (CVEProject cvelistV5) raw.githubusercontent.com
• Vulners PT-2026-116086 vulners.com
• Fork fix pull request (third-party): we-feed PR 4 github.com
• rachelos we-mp-rss GitHub repository github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:26.