CVE-2026-27963 Details
Description
Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.
A stored cross-site scripting vulnerability has been identified in the Audiobookshelf web application, affecting versions through 2.31.0. This vulnerability allows for the execution of arbitrary JavaScript by injecting malicious metadata into library items. Attackers with the ability to modify library content can exploit this issue, executing scripts in the context of users' browsers and potentially hijacking sessions or exfiltrating data. The vulnerability arises because the application’s tooltip component renders text using innerHTML without proper sanitization, enabling the execution of injected scripts.
Users can update to Audiobookshelf version 2.32.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478 | [email protected] | Patch |
| https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78 | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| audiobookshelf audiobookshelf | < 2.32.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |