Critical RCE in WeRSS 1.5.3 Allows Unauthenticated Code Execution
A critical flaw in WeRSS versions up to 1.5.3 lets attackers run OS commands via template injection without authentication.
Key points
- CVE-2026-111687 is rated CVSS 9.3, indicating critical severity for remote code execution.
- The vulnerability affects WeRSS (we-mp-rss) versions through 1.5.3 and requires no user login.
- Attackers exploit the /rss/{feed_id} endpoint by bypassing eval denylists via object-subclass traversal.
The National Vulnerability Database has published details for CVE-2026-111687, a critical remote code execution flaw in the WeRSS application. This vulnerability allows unauthenticated attackers to execute arbitrary code on systems running WeRSS versions up to and including 1.5.3. The issue stems from improper input validation in the public API endpoints.
The flaw exists within the GET /rss/{feed_id} endpoint, which is publicly accessible. According to the NVD record, attackers can supply a non-built-in ext value alongside a specific template string. This combination allows them to bypass the application’s eval denylist. The technique involves object-subclass traversal within the {{=expression}} template syntax.
Technical Context and Exploitation
The vulnerability is classified under CWE-95, which covers improper evaluation of dynamic code. The CVSS score of 9.3 reflects the ease of exploitation and the high impact of successful attacks. Because the endpoint is public and does not require authentication, any internet-facing instance is potentially vulnerable.
Attackers do not need valid credentials to exploit this issue. They simply craft a request with a malicious template. The object-subclass traversal method allows the attacker to reach functions that the denylist intended to block. This results in the execution of operating system commands as the service account running the application.
Affected Software and Scope
Only WeRSS, also known as we-mp-rss, is affected by this specific CVE. The vulnerability applies to all versions of the software up to 1.5.3. Organizations using this tool to aggregate or serve RSS feeds must check their current version.
The service account running the WeRSS process determines the level of access an attacker gains. If the service runs with elevated privileges, the compromise could be more severe. The NVD record does not specify if earlier versions are immune, only that versions through 1.5.3 contain the flaw.
What should you do?
Security teams should immediately identify if WeRSS is deployed in their environment. If the software is in use, verify the installed version against the affected range. Monitor network traffic for unusual requests to the /rss/{feed_id} endpoint. Restrict access to the application if it is not required to be publicly accessible.
What to do and how to stay safe: WeRSS
- Inventory all servers and containers to identify instances of WeRSS version 1.5.3 or earlier.
- Review firewall rules to restrict access to the /rss/{feed_id} endpoint to trusted networks only.
- Monitor server logs for unusual template parameters or object-subclass traversal patterns in requests.
- Prepare to isolate affected systems once the vendor provides a confirmed patch or update.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111687?
The Common Vulnerability Scoring System rate is 9.3, which is classified as critical severity.
Does an attacker need a login to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to execute code via the public endpoint.
Which versions of WeRSS are vulnerable?
All versions of WeRSS (we-mp-rss) through 1.5.3 are affected by this remote code execution issue.
