{"id":"CVE-2026-111687","title":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint","summary":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ex…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"rachelos","product":"we-mp-rss","affected":["we-mp-rss <= 1.5.3"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:22.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111687","references":[{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198","label":"disclosure@vulncheck.com"},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.01003,"epssPercentile":0.62726,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:04:57.256748Z"},"ingestedAt":"2026-10-16T18:43:08.657Z","slug":"CVE-2026-111687","body":"## Overview\n\nWeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":223354,"id":"CVE-2026-111687","ts":1792180179005,"field":"exploit_available","old":"false","new":"true"}]}