Unauthenticated RCE in WeRSS 1.5.3 via Template Injection Bypass

WeRSS, an open-source tool for converting WeChat articles to RSS feeds, exposes a severe remote code execution flaw. Security researchers identified that the application processes user-supplied input in its public API without adequate sanitization. This oversight allows attackers to inject malicious code directly into the server’s execution environment. The vulnerability affects all versions of the software up to and including 1.5.3.

Root cause

The vulnerability stems from improper handling of template parameters within the application’s logic. According to the National Vulnerability Database record for CVE-2026-111687, the flaw is classified under CWE-95, which denotes improper evaluation of expressions. The application fails to restrict the capabilities of the template engine when processing external inputs. This allows an attacker to traverse object subclasses and execute arbitrary expressions. The core issue is that the system trusts external data in a context where it should be treated as untrusted.

Attack path

An attacker does not need valid credentials to exploit this vulnerability. They target the public GET /rss/{feed_id} endpoint. By supplying a specific template parameter, the attacker can inject a {{=expression}} payload. This payload includes a non-built-in extension value that triggers object-subclass traversal. This technique bypasses the application’s existing eval denylist. Once the bypass succeeds, the attacker can run operating system commands. These commands execute with the privileges of the service account running the WeRSS application.

Affected versions

• WeRSS (we-mp-rss) version 1.5.3
• All versions of WeRSS prior to 1.5.3

Mitigation

• No official patch or fix has been confirmed yet by the vendor.
• Restrict network access to the WeRSS application to trusted internal networks only.
• Disable the public /rss/{feed_id} endpoint if external access is not strictly required.
• Monitor the vendor’s repository for an official security update or version bump.

Detection notes

Security teams should monitor web server access logs for unusual query parameters on public endpoints. Look for requests containing template syntax such as curly braces or equals signs. Check for outbound network connections from the web server process to unexpected destinations, which may indicate command execution. Review system logs for new processes spawned by the web service account. If suspicious activity is detected, isolate the affected host immediately to prevent lateral movement. Analyze memory dumps if possible to identify injected code.

What to do and how to stay safe: WeRSS

• Audit your public-facing endpoints to ensure they do not accept unvalidated template inputs.
• Implement strict input validation on all API parameters that influence server-side rendering.
• Review firewall rules to limit access to administrative and feed-generation endpoints.
• Prepare incident response playbooks for remote code execution scenarios involving web applications.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch available for CVE-2026-111687?

No, the source material does not mention any confirmed fix or updated version that resolves this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.3, rating it as critical.

Do attackers need credentials to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to execute code via the public endpoint.