GHSA-2h5r-cqfc-45v6MediumCVSS 5.4

Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name

Published
February 3, 2023
Last Modified
March 27, 2025

🔗 CVE IDs covered (1)

CVE-2023-23636 →

📋 Description

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

🎯 Affected products1

  • npm/jellyfin-web:>= 10.8.0, < 10.8.4

🔗 References (7)