CVE-2021-21278

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 7f1c430

Description: RSSHub is an open source, easy to use, and extensible RSS feed generator. The issue arises from some routes using eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues.

Recommendations: For versions prior to 7f1c430, upgrade to version 7f1c430 or later as soon as possible. As a temporary workaround, consider disabling the routes that use eval or Function constructor until the issue is resolved. Additionally, applying the no-new-func rule to eslint can help mitigate the risk.