CVSS 9.3: Unauthenticated RCE in WeRSS 1.5.3 via /rss Endpoint Bypasses Security Filters

Administrators using WeRSS must address a critical security flaw identified as CVE-2026-111687. The vulnerability exists in all versions of the software up to and including 1.5.3. According to the National Vulnerability Database, this issue allows unauthenticated attackers to run arbitrary code on the server hosting the application. The flaw is rated as Critical with a CVSS score of 9.3, indicating severe potential impact on system integrity and confidentiality.

In plain English

The vulnerability stems from how the application handles template data in its public feeds. An attacker does not need to log in or have a user account to exploit this weakness. By sending a specially crafted request to the public RSS feed endpoint, the attacker can inject malicious code. The system fails to properly validate this input, allowing the malicious code to be executed by the server. This means anyone on the internet can potentially take control of the server running the vulnerable version of the software.

The background

The technical root cause involves the template parameter within the public GET /rss/{feed_id} endpoint. According to the NVD record, attackers can supply a non-built-in extension value alongside a specific template expression. This combination allows the attacker to traverse object subclasses and bypass the application's denylist for the eval function. Consequently, the server executes operating system commands as the service account that runs the WeRSS application. This weakness is classified under CWE-95, which relates to improper neutralization of directives during data evaluation.

What changes now

Users running WeRSS version 1.5.3 or any earlier release are exposed to this critical risk. The source material does not state that a patch or fix has been released for these versions. Therefore, administrators must verify their current installation version immediately. If the system is running a vulnerable version, the risk of remote code execution is active. Organizations should treat this as a high-priority incident requiring immediate attention to prevent unauthorized access to their server infrastructure.

Who needs to act first

Teams should prioritize updating systems that are directly exposed to the internet without additional network protections. Check whether your WeRSS instance is accessible via public URLs or if it sits behind a firewall. If the service is publicly reachable, isolate the system from external traffic until an update is applied. Perform a full backup of the application and its database before making any changes. Test the update in a staging environment if possible to ensure compatibility. Monitor server logs for unusual activity that might indicate exploitation attempts while you prepare the remediation steps.

What to do and how to stay safe: WeRSS

• Verify the current version of WeRSS installed on your servers and compare it against the affected range.
• Restrict network access to the RSS feed endpoint if immediate patching is not possible.
• Monitor server logs for suspicious requests to the /rss/{feed_id} endpoint.
• Prepare to apply updates as soon as the vendor provides a confirmed fix.

Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality

General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111687?

The National Vulnerability Database assigns a CVSS score of 9.3, rating the vulnerability as Critical.

Do attackers need a login to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to execute code without needing credentials.

Which versions of WeRSS are affected by this vulnerability?

All versions of WeRSS through 1.5.3 are affected by this remote code execution flaw.