Remote Code Execution Vulnerability in WeRSS Product by We-MP
CVE-2026-111687

9.3CRITICAL

Key Information:

Vendor

Rachelos

Status
We-mp-rss
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111687?

WeRSS (we-mp-rss) versions up to 1.5.3 contain a vulnerability that enables unauthenticated attackers to execute arbitrary code. This vulnerability arises from the exploitation of the template parameter in the public GET /rss/{feed_id} endpoint. By supplying a non-built-in ext value alongside a manipulative {{=expression}} template, attackers can circumvent the eval denylist, ultimately allowing them to run operating system commands with the privileges of the service account. This risk emphasizes the need for immediate updates and security measures to mitigate potential exploits.

Affected Version(s)

we-mp-rss 0 <= 1.5.3

References

https://hackmd.io/@hieuPenguinnn/werss-rss-template-unaut...
third-party-advisory
https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/la...
technical-description
https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rs...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.