Unrated severityNVD Advisory· Published Feb 26, 2026· Updated Feb 26, 2026
Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
CVE-2026-27963
Description
Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <2.32.0
- Range: < 2.32.0
Patches
Vulnerability mechanics
References
2- github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478mitrex_refsource_MISC
- github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.