Nixpkgs Security Tracker

Login with GitHub

Suggestions search

Published
Filter by:
With package: audiobookshelf

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-27963
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 3 weeks, 3 days ago by @LeSuisse Activity log
  • Created automatic suggestion 3 weeks, 3 days ago
  • @LeSuisse removed
    4 packages
    • pkgsRocm.audiobookshelf
    • python312Packages.aioaudiobookshelf
    • python313Packages.aioaudiobookshelf
    • python314Packages.aioaudiobookshelf
    3 weeks, 3 days ago
  • @LeSuisse accepted 3 weeks, 3 days ago
  • @LeSuisse published on GitHub 3 weeks, 3 days ago
Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.

References

Affected products

audiobookshelf
  • ==< 2.32.0

Matching in nixpkgs

Ignored packages (4)

Package maintainers

Upstream advisory: https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78
Upstream patch: https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478