Executive brief
PeerTube, an open-source video streaming platform, contains a security flaw in how it displays video information. An attacker can upload a video with specially crafted metadata that executes malicious code in the web browsers of other users who view the video page. This could allow an attacker to perform actions on behalf of users or interfere with their session on that specific PeerTube site.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in PeerTube's server-side rendering of video watch pages. The application embeds video metadata into a schema.org JSON-LD block using JSON.stringify() without escaping HTML-sensitive characters like '<', '>', or '/'. An attacker with permission to upload or edit video metadata can inject a '</script>' sequence to terminate the existing script block and execute arbitrary JavaScript in the context of the instance's origin. This affects visitors viewing the attacker's video page. The issue is addressed in version 8.2.2 by properly escaping configuration and metadata when injecting it into HTML.
Affected products
- Chocobozzz PeerTube < 8.2.2
Timeline
- 2026-06-17: advisory: Internal GHSA advisory published
- 2026-07-02: patched: Version 8.2.2 released
- 2026-07-10: disclosed: CVE-2026-57167 published