registry / nodebb-plugin-rss / 4.1.0

nodebb-plugin-rss@4.1.0

A RSS Plugin to pull feeds and post them in to categories

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The plugin can make server-side HTTP requests to arbitrary RSS URLs supplied through its feed configuration or check endpoint. No malware-like execution or exfiltration chain was found.

Static reason

No blocking static signals were detected.

Trigger

A caller supplies a feed URL or an administrator saves a feed; configured jobs then run periodically.

Impact

Potential SSRF against services reachable from the NodeBB host.

Mechanism

Unrestricted server-side RSS URL fetching

Rationale

No malicious behavior is present, but unrestricted backend URL fetching is a concrete unresolved SSRF risk. Downgrade to warning rather than block.

Evidence

index.jslib/feed.jslib/jobs.jslib/pull.jslib/controllers.jspackage.jsonplugin.json

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

lib/feed.js passes arbitrary feed URLs to rss-parser parseURL
GET /api/admin/plugins/rss/checkFeed fetches req.query.url without URL restrictions

nodebb-plugin-rss@4.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code