CVE-2026-27963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27963", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:24:57.792Z", "datePublished": "2026-02-26T02:08:21.298Z", "dateUpdated": "2026-02-26T14:43:59.379Z"}, "containers": {"cna": {"title": "Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78"}, {"name": "https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478", "tags": ["x_refsource_MISC"], "url": "https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478"}], "affected": [{"vendor": "advplyr", "product": "audiobookshelf", "versions": [{"version": "< 2.32.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:08:21.298Z"}, "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-69cp-m725-wf78", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:43:02.609979Z", "id": "CVE-2026-27963", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:43:59.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27963", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T14:43:02.609979Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:43:46.404Z"}}], "cna": {"title": "Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata", "source": {"advisory": "GHSA-69cp-m725-wf78", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "advplyr", "product": "audiobookshelf", "versions": [{"status": "affected", "version": "< 2.32.0"}]}], "references": [{"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78", "name": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478", "name": "https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:08:21.298Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27963", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:43:59.379Z", "dateReserved": "2026-02-25T03:24:57.792Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T02:08:21.298Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "audiobookshelf", "vendor": "advplyr", "versions": [{"status": "affected", "version": "< 2.32.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CC230DA-0DE9-4D9F-AB14-18D06184617E", "versionEndExcluding": "2.32.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue."}, {"lang": "es", "value": "Audiobookshelf es un servidor de audiolibros y podcasts autoalojado. Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en las versiones anteriores a la 2.32.0 de la aplicaci\u00f3n, la cual permite la ejecuci\u00f3n arbitraria de JavaScript a trav\u00e9s de metadatos de biblioteca maliciosos. Atacantes con privilegios de modificaci\u00f3n de biblioteca pueden ejecutar c\u00f3digo en los navegadores de los usuarios v\u00edctimas, lo que podr\u00eda llevar al secuestro de sesi\u00f3n y a la exfiltraci\u00f3n de datos. La versi\u00f3n 2.32.0 contiene un parche para el problema."}], "id": "CVE-2026-27963", "lastModified": "2026-06-17T10:27:58.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27963", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:43:02.609979Z", "version": "2.0.3"}}]}, "published": "2026-02-26T03:16:04.687", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.32.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "audiobookshelf", "source": "cna", "vendor": "advplyr"}, "product": "audiobookshelf", "vendor": "advplyr"}], "analysis": {"en": {"generated_at": "2026-04-17T14:28:26.118187+00:00", "value": {"mitigation_remediation": ["Upgrade Audiobookshelf to version 2.32.0 or later to apply the official fix.", "Restrict library\u2011modification permissions to trusted administrators or disable editing of metadata that populates tooltip content.", "If an upgrade is not immediately possible, implement input sanitization on metadata fields or enforce a strict Content\u2011Security Policy to mitigate the impact of XSS."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Audiobookshelf web application from the vendor advplyr in any release older than 2.32.0.", "description_and_impact": "Audiobookshelf, a self\u2011hosted audiobook and podcast server, contains a stored cross\u2011site scripting flaw in its Tooltip.vue component that can be triggered via malicious library metadata. Attackers with the ability to modify library entries can inject arbitrary JavaScript executed in any user\u2019s browser, enabling session hijacking and data exfiltration, and the weakness is classified as CWE\u201179.", "risk_and_exploitability": "The flaw carries a CVSS score of 4.8, reflecting moderate risk, and an EPSS score of less than 1%, indicating a low likelihood of exploitation in the wild; it is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to have library\u2011modification privileges, so the attack vector is typically internal or result of a compromised account."}}}}, "created": "2026-02-26T13:09:48.967983+00:00", "updated": "2026-04-17T14:30:20.831860+00:00", "vendors": ["advplyr", "advplyr$PRODUCT$audiobookshelf"]}