Unrated severityNVD Advisory· Published Feb 26, 2026· Updated Feb 26, 2026
Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
CVE-2026-27963
Description
Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.
Affected products
2- Range: <2.32.0
- advplyr/audiobookshelfv5Range: < 2.32.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478mitrex_refsource_MISC
- github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.