CVE-2026-111687 in we-mp-rss
Summary
by MITRE • 10/16/2026
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in WeRSS, specifically versions through 1.5.3, represents a critical remote code execution flaw rooted in improper neutralization of special elements used in an operating system command shell. This security defect is located within the public GET /rss/{feed_id} endpoint, which processes user-supplied input via the template parameter without adequate sanitization or validation mechanisms. The core technical issue stems from the application's use of a templating engine that allows for dynamic expression evaluation. While the developers implemented an eval denylist to prevent direct execution of dangerous functions, this protection mechanism is insufficient against sophisticated bypass techniques involving object-subclass traversal.
Attackers can exploit this flaw by supplying a non-built-in ext value alongside a carefully crafted {{=expression}} template string. The vulnerability arises because the application fails to strictly restrict the types of objects that can be instantiated or accessed during the evaluation process. By leveraging Python's dynamic nature, an attacker can traverse object subclasses to access built-in classes and functions that are not explicitly blocked by the denylist. This traversal allows the malicious payload to bypass the intended security controls and ultimately execute arbitrary operating system commands with the privileges of the service account running the WeRSS application.
From a classification perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically involving server-side template injection. The attack vector is categorized under ATT&CK technique T1059, Command and Scripting Interpreter, as it enables the execution of system-level commands through a web application interface. The lack of input validation on the template parameter allows for this code injection to occur remotely without any form of authentication, significantly lowering the barrier for exploitation by unauthenticated adversaries.
The operational impact of this vulnerability is severe, potentially leading to full compromise of the underlying server infrastructure. Since the code executes as the service account, an attacker could exfiltrate sensitive data stored within the RSS feeds or associated databases, modify application configurations, install backdoors, or use the compromised system as a pivot point for further network attacks. The ability to run commands with elevated privileges means that the integrity and confidentiality of the entire hosting environment are at risk.
To mitigate this vulnerability, immediate action is required to upgrade WeRSS to version 1.5.4 or later where these issues have been addressed. In addition to upgrading, administrators should implement strict input validation on all user-supplied parameters, particularly those involved in templating engines. It is crucial to avoid using dynamic expression evaluation features unless absolutely necessary and to employ allow-listing rather than deny-listing for permitted inputs. Furthermore, deploying a Web Application Firewall can provide an additional layer of defense by filtering out malicious template injection patterns before they reach the application logic. Ensuring that the service account runs with minimal privileges will also help limit the potential damage in case of a successful exploitation attempt.