WeRSS EUVD-2026-102978

No special conditions beyond the product being reachable - remote unauthenticated exploitation against the public GET /rss/{feed_id} endpoint of we-mp-rss through 1.5.3. The attacker must supply a template parameter containing a non-built-in ext value together with a {{=expression}} payload whose object-subclass traversal bypasses the eval denylist to reach OS command execution. Limiting factors: the target must be running we-mp-rss version 1.5.3 or earlier with the /rss endpoint network-accessible to the attacker; no authentication, user interaction, or non-default configuration is required, so the practical barrier is low. Impact is bounded by the privileges of the service account running the application.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-case profile for exploitability: fully remote, low complexity, no authentication, and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with unauthenticated remote code execution. The affected endpoint (GET /rss/{feed_id}) is explicitly public, which supports the PR:N rating. A detailed public technical writeup exists (hackmd) describing the object-subclass traversal that bypasses the eval denylist, so publicly available exploit details exist, materially lowering the barrier to weaponization. Against these aggravating signals, the mitigating factor is footprint: we-mp-rss is a niche open-source self-hosted WeChat-MP-to-RSS tool, so widespread opportunistic exploitation is less likely than for mainstream software. Key gaps: no EPSS score was provided in the input, and this CVE is NOT on CISA KEV, so there is no evidence of confirmed active exploitation - risk is driven by ease of exploitation and public POC details, not by observed in-the-wild attacks. Anyone running we-mp-rss ≤1.5.3 with a reachable /rss endpoint should treat this as urgent.

An attacker locates an internet-exposed we-mp-rss instance (≤1.5.3) and sends a single crafted GET request to the public /rss/{feed_id} endpoint, supplying a malicious template parameter. Because a public technical writeup (hackmd) documents the exact object-subclass traversal that evades the eval denylist, the attacker can reliably execute OS commands as the service account without any credentials or user interaction. This yields immediate remote code execution and a foothold on the host.