CVE-2026-111687

{
  "etk_id": "ETK-2026-1810",
  "cve_id": "CVE-2026-111687",
  "display_id": "CVE-2026-111687",
  "ghsa_id": "GHSA-hp95-p2ww-6rvc",
  "euvd_id": "EUVD-2026-102978",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated template injection in we-mp-rss",
  "summary": "We-mp-rss versions through 1.5.3 allow attacker-controlled template input on the public RSS endpoint to be evaluated. An unauthenticated remote attacker who can reach that endpoint may execute commands with the privileges of the service account.",
  "mitigation": "Disable or restrict public access to the RSS endpoint, and reject template-related request parameters at a reverse proxy where possible. Run the service with minimal privileges and monitor for an upstream release that fixes versions through 1.5.3.",
  "vendor": "rachelos",
  "product": "we-mp-rss",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.5.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "we-mp-rss",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.01,
  "epss_percentile": 0.6234,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 28.861013866666667,
  "t0_at": "2026-10-16T17:39:44.866000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T21:28:21.199883+00:00",
      "days": 0.15875386438657407,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T17:39:44.866000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-16T21:28:21.199883+00:00",
      "days": 0.15875386438657407,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T17:39:44.866000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T17:39:44.866000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T17:39:44.866000+00:00",
      "url": "https://github.com/advisories/GHSA-hp95-p2ww-6rvc"
    }
  }
}