Remote Code Execution in WeRSS via Template Injection

WeRSS (we-mp-rss) through version 1.5.3 is susceptible to a critical remote code execution vulnerability (CVE-2026-111687). The vulnerability resides in the public GET /rss/{feed_id} endpoint, where the application improperly validates the template parameter. An unauthenticated attacker can exploit this by supplying a crafted 'ext' value alongside a '{{=expression}}' template. By utilizing object-subclass traversal techniques, the attacker can successfully bypass the application's eval denylist to execute arbitrary OS commands. This vulnerability allows for full system compromise under the context of the service account running the WeRSS application. Given the severity of the flaw (CVSS 9.8), organizations utilizing this software should immediately restrict access to the affected endpoint or upgrade to a patched version.

Impact

Successful exploitation allows for unauthenticated remote code execution, granting attackers the ability to run OS commands with the privileges of the WeRSS service account. This could lead to full system compromise, data exfiltration, or deployment of further malicious payloads. The scope of targeting is global, affecting any instance of WeRSS version 1.5.3 or lower exposed to the network.

Recommendation

• Immediately restrict public access to the /rss/ endpoint via a Web Application Firewall (WAF) or reverse proxy configuration until the software is patched.
• Audit access logs for anomalous GET requests to the /rss/ URI containing the {{= string sequence.
• Monitor the WeRSS service process for the execution of unexpected child processes such as cmd.exe, /bin/sh, or curl.
• Patch the WeRSS application as soon as an official security update from the vendor is released.