External risk intelligence

WeRSS Remote Code Execution via Template Parameter

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111687

The vulnerability exists in a public GET endpoint (/rss/{feed_id}) that is designed to be accessible without authentication. As a web-based RSS service endpoint, it is public-facing by design in normal operations, allowing unauthenticated attackers to interact directly with the vulnerable code via standard web requests.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote code execution vulnerability has been identified in the WeRSS service, specifically within its template processing for RSS feeds. This flaw allows unauthenticated attackers to potentially run commands on the service's underlying operating system by manipulating the template parameter in a public API request. The main concern is confirming whether this specific service is in use within our environment and, if so, the extent of its exposure.

Attackers can run commands remotely.
This could impact our systems if we use the service.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the public `/rss/{feed_id}` endpoint. By manipulating the `template` parameter with a non-built-in `ext` value and a specific `{{=expression}}` format, the attacker can bypass security checks and execute arbitrary operating system commands with the privileges of the service account.

No authentication required to access.
Triggered by crafted `template` parameter.
Allows unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary operating system commands as the service account. This occurs when an attacker provides a specially crafted template expression to the `template` parameter in a GET request to the public `/rss/{feed_id}` endpoint, bypassing security filters to achieve command injection.

Service account commands could be executed.
Via unauthenticated GET request to `/rss/{feed_id}`.
Arbitrary OS command execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This remote code execution vulnerability in WeRSS affects systems exposing the public GET /rss/{feed_id} endpoint. The likely first step for responsible teams—such as application owners, platform teams, or security operations—is to identify all instances of WeRSS, determine their exposure and criticality, and then coordinate remediation.

Application owners must own the issue.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WeRSS software?

WeRSS (we-mp-rss) is a software service designed to generate and serve RSS feeds. It provides a web-based interface for users to fetch feed data through specific endpoints, which typically act as a bridge between internal data and external feed consumers.

What does CVE-2026-111687 mean?

This is a Remote Code Execution (RCE) vulnerability classified as CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. In simple terms, the software fails to properly filter user-supplied input when processing templates, allowing an attacker to escape intended limitations and run unauthorized system commands.

How is this vulnerability triggered?

An attacker triggers this by sending a crafted GET request to the /rss/{feed_id} endpoint. They must specifically manipulate the 'template' parameter using a non-built-in extension and a specially formatted expression. Sending a standard, well-formed request without these malicious components does not trigger the vulnerability.

Why should I care about this CVE?

Halo Surface Signal indicates this vulnerability is critical because it exists in a public-facing endpoint designed for unauthenticated access. If your service is exposed to the internet, any remote attacker can attempt to execute commands on your server without needing valid credentials.

What is the first step to address this?

Your priority is to inventory your environment to locate all running instances of the WeRSS service. Once identified, evaluate whether these instances are reachable from the internet or other untrusted networks, and coordinate with the application owners to plan remediation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.