~ / search / GHSA-749c-pc87-4qcw

GHSA-749c-pc87-4qcw

Jellyfin Web Cross-Site Scripting (XSS) via Collection Name

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-23635

Packages

EcosystemPackageAffectedFixed in
npm jellyfin-web >= 10.8.0, < 10.8.4 10.8.4

Details

As written in the advisory (Markdown source, shown as plain text).

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

References

External links from the advisory. They lead to third-party sites.