Executive brief
Jellyfin Web is a browser-based interface for managing and viewing media content in a Jellyfin media server. A stored XSS vulnerability in collection names allows attackers to inject malicious scripts that execute when other users view collections, potentially stealing authentication tokens and compromising user accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Jellyfin Web versions 10.8.0 through 10.8.3, classified as CWE-79. The root cause is improper HTML escaping of item/collection names when rendering aria-labels in item card components. An attacker with the ability to edit item/collection names can inject malicious JavaScript payloads (e.g., <img src=/X onerror=alert("xss")>) that execute in the browser context of any user viewing the affected collection. The attack requires authenticated access to create or modify collections, and user interaction (viewing the affected content), but can result in theft of localStorage-stored access tokens. The vulnerability was fixed in version 10.8.4.
Affected products
- Jellyfin Jellyfin Web 10.8.0 through 10.8.3
Timeline
- 2023-02-03: disclosed: GHSA advisory published
- 2023-02-03: patched: Fixed in Jellyfin 10.8.4