Medium severity4.8NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026

CVE-2026-27963

Description

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Audiobookshelf/Audiobookshelf
cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*
Range: <2.32.0
Advplyr/Audiobookshelfllm-fuzzy2 versions
<2.32.0+ 1 more
- (no CPE)range: <2.32.0
- (no CPE)range: < 2.32.0

Patches

Vulnerability mechanics

References

github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478nvdPatch
github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78nvdExploitMitigationPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000