CVSS 9.3 Flaw in WeRSS 1.5.3 Lets Attackers Run Code via Template Injection
A critical flaw in WeRSS allows attackers to execute arbitrary code via template injection without authentication, posing severe risks to exposed servers.
Key points
- CVE-2026-111687 affects WeRSS versions up to and including 1.5.3.
- The vulnerability receives a CVSS score of 9.3, rated as critical.
- Attackers exploit the public /rss/{feed_id} endpoint to bypass security filters.
The open-source project WeRSS contains a critical remote code execution flaw that impacts versions through 1.5.3. According to the National Vulnerability Database, this vulnerability allows unauthenticated attackers to run arbitrary operating system commands on affected servers without needing valid credentials.
The issue stems from improper input validation in the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in extension value combined with a specific template expression. This combination enables object-subclass traversal that successfully bypasses the application's eval denylist.
Technical context
The vulnerability is classified under CWE-95, which relates to improper evaluation of expressions. The flaw allows attackers to inject malicious code into the template engine. By manipulating the expression syntax, adversaries can execute commands as the service account running the WeRSS application. This grants them the same level of access as the service itself.
Affected systems
Any organization running WeRSS version 1.5.3 or earlier is potentially exposed. The vulnerability exists in the public-facing RSS feed endpoint, meaning it is accessible to anyone on the internet. There is no requirement for user login or authentication to exploit this flaw, making it highly attractive to automated scanning tools and malicious actors.
Defender's checklist
Security teams should immediately identify all instances of WeRSS within their infrastructure. Administrators must verify the current version of the software on all servers. If version 1.5.3 or older is detected, it is considered vulnerable. Organizations should monitor server logs for unusual activity on the /rss endpoint, such as unexpected command executions or outbound connections from the service account.
Operational impact
When a critical remote code execution flaw is discovered, operations teams must prioritize inventory verification. Managers should ask whether any customer-facing services rely on the affected software. IT leads need to determine if the service account has excessive privileges that could allow lateral movement. Communication should flow to legal and compliance departments to assess data exposure risks. Teams usually review access logs to detect prior compromise indicators.
What to do and how to stay safe: WeRSS
- Audit all servers to identify if WeRSS version 1.5.3 or older is installed.
- Restrict network access to the /rss endpoint if immediate removal is not possible.
- Monitor system logs for unauthorized command execution or unusual outbound traffic.
- Prepare an incident response plan in case the service account is compromised.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111687?
The vulnerability has a CVSS score of 9.3, which is rated as critical.
Which versions of WeRSS are affected by this flaw?
All versions of WeRSS through 1.5.3 are affected by this remote code execution vulnerability.
Does the attacker need to authenticate to exploit this?
No, the vulnerability allows unauthenticated attackers to execute code via the public endpoint.
