Search
Find a vulnerability
Search criteria
6 vulnerabilities found for PeerTube by Chocobozzz
CVE-2026-73211 (GCVE-0-2026-73211)
Vulnerability from nvd – Published: 2026-08-11 17:22 – Updated: 2026-08-11 19:01
VLAI
EPSS
VEX
Title
PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 19:01 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/cc0… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.1.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73211",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T19:01:06.392400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T19:01:32.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:22:00.200Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8"
}
],
"source": {
"advisory": "GHSA-pqr4-34h8-g39x",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73211",
"datePublished": "2026-08-11T17:22:00.200Z",
"dateReserved": "2026-08-11T14:41:20.121Z",
"dateUpdated": "2026-08-11T19:01:32.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73090 (GCVE-0-2026-73090)
Vulnerability from nvd – Published: 2026-08-11 17:19 – Updated: 2026-08-13 14:06
VLAI
EPSS
VEX
Title
PeerTube: Cross-origin remote video takeover via Update activity
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:06 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/63d… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:06:14.677948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:06:30.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server\u0027s video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:19:30.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"
}
],
"source": {
"advisory": "GHSA-g9p4-f7h8-hc86",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Cross-origin remote video takeover via Update activity"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73090",
"datePublished": "2026-08-11T17:19:30.272Z",
"dateReserved": "2026-08-10T19:37:41.445Z",
"dateUpdated": "2026-08-13T14:06:30.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57167 (GCVE-0-2026-57167)
Vulnerability from nvd – Published: 2026-07-10 16:37 – Updated: 2026-07-10 17:42
VLAI
EPSS
VEX
Title
PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 17:42 UTC
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/453… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T17:42:35.684811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:42:51.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker\u0027s videos. This issue is fixed in version 8.2.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T16:37:59.631Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"
}
],
"source": {
"advisory": "GHSA-jxwq-h9xv-hr28",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57167",
"datePublished": "2026-07-10T16:37:59.631Z",
"dateReserved": "2026-06-24T01:47:55.285Z",
"dateUpdated": "2026-07-10T17:42:51.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73211 (GCVE-0-2026-73211)
Vulnerability from cvelistv5 – Published: 2026-08-11 17:22 – Updated: 2026-08-11 19:01
VLAI
EPSS
VEX
Title
PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 19:01 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/cc0… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.1.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73211",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T19:01:06.392400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T19:01:32.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:22:00.200Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8"
}
],
"source": {
"advisory": "GHSA-pqr4-34h8-g39x",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73211",
"datePublished": "2026-08-11T17:22:00.200Z",
"dateReserved": "2026-08-11T14:41:20.121Z",
"dateUpdated": "2026-08-11T19:01:32.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73090 (GCVE-0-2026-73090)
Vulnerability from cvelistv5 – Published: 2026-08-11 17:19 – Updated: 2026-08-13 14:06
VLAI
EPSS
VEX
Title
PeerTube: Cross-origin remote video takeover via Update activity
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:06 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/63d… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:06:14.677948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:06:30.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server\u0027s video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:19:30.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"
}
],
"source": {
"advisory": "GHSA-g9p4-f7h8-hc86",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Cross-origin remote video takeover via Update activity"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73090",
"datePublished": "2026-08-11T17:19:30.272Z",
"dateReserved": "2026-08-10T19:37:41.445Z",
"dateUpdated": "2026-08-13T14:06:30.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57167 (GCVE-0-2026-57167)
Vulnerability from cvelistv5 – Published: 2026-07-10 16:37 – Updated: 2026-07-10 17:42
VLAI
EPSS
VEX
Title
PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 17:42 UTC
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/453… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T17:42:35.684811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:42:51.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker\u0027s videos. This issue is fixed in version 8.2.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T16:37:59.631Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"
}
],
"source": {
"advisory": "GHSA-jxwq-h9xv-hr28",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57167",
"datePublished": "2026-07-10T16:37:59.631Z",
"dateReserved": "2026-06-24T01:47:55.285Z",
"dateUpdated": "2026-07-10T17:42:51.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}