Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url), creates a subscript…
High CVSS 7.7
Summary
Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url), creates a subscription through FeedService.create_subscription(), and enqueues fetch_feed_task. The background path calls fetch_feed(feed.url) and parse_feed(), which assigns each RSS item link to ParsedEntry.url. The task then passes ParsedEntry.url to fetch_and_extract_fulltext(parsed_entry.url) without network-leve…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/LeslieLeung/glean/commit/cdc05dd34df58d8d210e0cbed0ccc60108e4eeed
- https://github.com/LeslieLeung/glean/releases/tag/v0.2.6
- https://github.com/LeslieLeung/glean/security/advisories/GHSA-78qf-q8fg-jcpg
- https://github.com/LeslieLeung/glean/security/advisories/GHSA-78qf-q8fg-jcpg
Timeline
- nvd_ingest NVD