Executive brief
Jellyfin is a popular open-source media system used to manage and stream personal media collections. A security flaw in the web interface allows an attacker to inject malicious scripts into playlist names or item labels. If a user views the affected item, the attacker could steal their login session tokens, potentially leading to unauthorized account access.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Jellyfin Web versions 10.8.0 through 10.8.3. The root cause is the improper neutralization of HTML input within the 'aria-label' attributes of item cards and playlist names used for accessibility. An authenticated attacker can inject a malicious payload (e.g., an img tag with an onerror handler) into an item's name property. When another user navigates to a page displaying the affected item card, the script executes in their browser context, enabling the theft of access tokens from localStorage. This issue was fixed in version 10.8.4 by properly escaping item names in the card components.
Affected products
- Jellyfin Jellyfin Web 10.8.0 - 10.8.3
Timeline
- 2022-08-02: disclosed: Vulnerability reported to Jellyfin by Christian Pöschl of usd AG
- 2022-08-02: patched: Fix merged into release-10.8.z branch
- 2022-08-14: advisory: Official release of version 10.8.4 containing the fix
- 2023-02-03: advisory: GitHub Security Advisory published