CVE-2026-57167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57167", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T01:47:55.285Z", "datePublished": "2026-07-10T16:37:59.631Z", "dateUpdated": "2026-07-10T17:42:51.158Z"}, "containers": {"cna": {"title": "PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28"}, {"name": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3", "tags": ["x_refsource_MISC"], "url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3"}, {"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"}], "affected": [{"vendor": "Chocobozzz", "product": "PeerTube", "versions": [{"version": "< 8.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T16:37:59.631Z"}, "descriptions": [{"lang": "en", "value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2."}], "source": {"advisory": "GHSA-jxwq-h9xv-hr28", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T17:42:35.684811Z", "id": "CVE-2026-57167", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T17:42:51.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T17:42:35.684811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T17:42:44.180Z"}}], "cna": {"title": "PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "source": {"advisory": "GHSA-jxwq-h9xv-hr28", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Chocobozzz", "product": "PeerTube", "versions": [{"status": "affected", "version": "< 8.2.2"}]}], "references": [{"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28", "name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3", "name": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2", "name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T16:37:59.631Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57167", "state": "PUBLISHED", "dateUpdated": "2026-07-10T17:42:51.158Z", "dateReserved": "2026-06-24T01:47:55.285Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T16:37:59.631Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PeerTube", "vendor": "Chocobozzz", "versions": [{"status": "affected", "version": "< 8.2.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2."}, {"lang": "es", "value": "PeerTube es una plataforma de transmisi\u00f3n de video federada con ActivityPub. Antes de la versi\u00f3n 8.2.2, las p\u00e1ginas de visualizaci\u00f3n de video renderizadas en el lado del servidor incrustaban un bloque JSON-LD de schema.org al aplicar JSON.stringify a los metadatos del video sin escapar los caracteres de menor que, mayor que o barra inclinada, lo que permit\u00eda que un valor que conten\u00eda la secuencia de bytes que cierra un elemento script inyectara HTML o JavaScript arbitrario que se ejecuta en el origen de la instancia para los visitantes de los videos del atacante. Este problema se solucion\u00f3 en la versi\u00f3n 8.2.2."}], "id": "CVE-2026-57167", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57167", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T17:42:35.684811Z", "version": "2.0.3"}}]}, "published": "2026-07-10T17:17:01.430", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3"}, {"source": "security-advisories@github.com", "url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PeerTube", "source": "cna", "vendor": "Chocobozzz"}, "product": "peertube", "vendor": "chocobozzz"}], "created": "2026-07-12T05:00:05.077730+00:00", "updated": "2026-08-03T04:15:03.741174+00:00", "vendors": ["chocobozzz", "chocobozzz$PRODUCT$peertube"]}