Intel

AIKIDO-2025-10292

feed is vulnerable to Improper Input Validation

Improper Input Validation Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.

21

Low Risk

This Affects:

JSfeed
0.1.0 - 4.2.2
Fixed in 5.0.0

TL;DR

Affected versions of this package are vulnerable to improper input validation at multiple points in the code, such as when formatting the url in enclosures or processing XML feeds.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

feed is vulnerable to Improper Input Validation in versions 0.1.0 - 4.2.2.

How to fix this

Upgrade the feed library to the patch version.