VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Feb 3, 2023· Updated Jun 17, 2026

CVE-2023-23636

CVE-2023-23636

Description

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
jellyfin-webnpm
>= 10.8.0, < 10.8.410.8.4

Affected products

3
  • Jellyfin/Jellyfin2 versions
    cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*range: >=10.8.0,<=10.8.3
    • (no CPE)
  • ghsa-coords
    pkg:npm/jellyfin-web
    Range: >= 10.8.0, < 10.8.4

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.