Suggestions search

Untriaged

Filter by:

With package: peertube

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-73211

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

Created suggestion 1 month ago
@LeSuisse ignored package peertube-viewer 1 month ago

PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

References

https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x x_refsource_CONFIRM
https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4 x_refsource_MISC
https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6 x_refsource_MISC
https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8 x_refsource_MISC

Affected products

PeerTube

==< 8.1.6

Matching in nixpkgs

pkgs.peertube

Free software to take back control of your videos

nixos-unstable 8.1.8
- nixpkgs-unstable 8.1.8
- nixos-unstable-small 8.2.3
nixos-26.05 8.1.8
- nixos-26.05-small 8.2.2
- nixpkgs-26.05-darwin 8.1.8

Ignored packages (1)

pkgs.peertube-viewer

Simple CLI browser for the peertube federated video platform

nixos-unstable 1.8.6
- nixpkgs-unstable 1.8.6
- nixos-unstable-small 1.8.6
nixos-26.05 1.8.6
- nixos-26.05-small 1.8.6
- nixpkgs-26.05-darwin 1.8.6

Package maintainers

@phanirithvij Phani Rithvij <phanirithvij2000@gmail.com>
@Prince213 Sizhe Zhao <prc.zhao@outlook.com>
@ethancedwards8 Ethan Carter Edwards <ethan@ethancedwards.com>
@eljamm Fedi Jamoussi <fedi.jamoussi@protonmail.ch>
@stevenroose Steven Roose <github@stevenroose.org>
@immae Ismaël Bouya <ismael@bouya.org>
@Izorkin Yurii Izorkin <Izorkin@gmail.com>

Permalink CVE-2026-73090

9.3 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created suggestion 1 month ago

PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.