~ / search / GHSA-2h5r-cqfc-45v6

GHSA-2h5r-cqfc-45v6

Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-23636

Packages

EcosystemPackageAffectedFixed in
npm jellyfin-web >= 10.8.0, < 10.8.4 10.8.4

Details

As written in the advisory (Markdown source, shown as plain text).

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

References

External links from the advisory. They lead to third-party sites.