CVE-2026-111687

Summary

WeRSS through version 1.5.3 has a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands via template parameter manipulation. This flaw is particularly dangerous because it can be exploited without any authentication and can run code as the service account.

Exploitability

The exploit is highly straightforward with no authentication required, allowing attackers to execute OS commands through crafted template expressions in the RSS feed endpoint.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise the WeRSS service and potentially access all systems that the service account has access to, including other network resources or data stores.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.5.4 or later to fix this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.