CVE-2026-57167 Details
Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.
A cross-site scripting vulnerability has been identified in PeerTube, a federated video streaming platform, in versions prior to 8.2.2. The issue arises in server-side-rendered video watch pages, which embed a schema.org JSON-LD block by using JSON.stringify on video metadata. This method fails to properly escape certain characters, allowing an attacker to inject arbitrary HTML or JavaScript. The injected script executes in the context of the instance origin, but only for visitors watching the attacker's videos.
Users are advised to upgrade to PeerTube version 8.2.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3 | [email protected] | Source CodeVendor |
| https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 | [email protected] | Release NotesVendor |
| https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PeerTube | <= 8.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |