CVE-2026-57167

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3
https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2
https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) PeerTube es una plataforma de transmisión de video federada con ActivityPub. Antes de la versión 8.2.2, las páginas de visualización de video renderizadas en el lado del servidor incrustaban un bloque JSON-LD de schema.org al aplicar JSON.stringify a los metadatos del video sin escapar los caracteres de menor que, mayor que o barra inclinada, lo que permitía que un valor que contenía la secuencia de bytes que cierra un elemento script inyectara HTML o JavaScript arbitrario que se ejecuta en el origen de la instancia para los visitantes de los videos del atacante. Este problema se solucionó en la versión 8.2.2.

Information

Published : 2026-07-10 17:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-57167

Mitre link : CVE-2026-57167

CVE.ORG link : CVE-2026-57167

JSON object : View

Products Affected

No product.

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-57167", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57167", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T17:42:35.684811Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Chocobozzz", "product": "PeerTube", "versions": [{"status": "affected", "version": "< 8.2.2"}]}]}], "published": "2026-07-10T17:17:01.430", "references": [{"url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3", "source": "security-advisories@github.com"}, {"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2."}, {"lang": "es", "value": "PeerTube es una plataforma de transmisi\u00f3n de video federada con ActivityPub. Antes de la versi\u00f3n 8.2.2, las p\u00e1ginas de visualizaci\u00f3n de video renderizadas en el lado del servidor incrustaban un bloque JSON-LD de schema.org al aplicar JSON.stringify a los metadatos del video sin escapar los caracteres de menor que, mayor que o barra inclinada, lo que permit\u00eda que un valor que conten\u00eda la secuencia de bytes que cierra un elemento script inyectara HTML o JavaScript arbitrario que se ejecuta en el origen de la instancia para los visitantes de los videos del atacante. Este problema se solucion\u00f3 en la versi\u00f3n 8.2.2."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}