CVE-2026-27963CWE-79

Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

Medium · published February 26, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00326 · 24.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-26T02:08Z
EPSS history
Timeline
  • 26 FEB 02:08Z
    Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
    cvelistv5