What is the CVSS score of CVE-2026-41167?

CVE-2026-41167 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Jellystat are affected by CVE-2026-41167?

Jellystat versions before 1.1.10 contain a critical SQL injection vulnerability that allows authenticated attackers to execute arbitrary commands on PostgreSQL database servers, potentially…. A patch is available.

How to fix or mitigate CVE-2026-41167?

Within 24 hours: Inventory all Jellystat deployments and confirm versions in use. Within 7 days: Apply vendor-released patch by upgrading Jellystat to version 1.1.10 or later (confirmed via GitHub commit 735fe7c) and restart all instances. Within 30 days: Conduct credential rotation for all Jellyfin API keys and Jellystat admin accounts; audit PostgreSQL database access logs for SQL injection patterns and unauthorized queries; review and restrict PostgreSQL user privileges to principle of least privilege (remove superuser if possible).

Jellystat CVE-2026-41167

EUVD-2026-25098 CRITICAL

SQL Injection (CWE-89)

2026-04-22 GitHub_M

Docker SQLi PostgreSQL

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 29, 2026 - 20:46 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:45 vuln.today

Patch available

Apr 22, 2026 - 22:02 EUVD

EUVD ID Assigned

Apr 22, 2026 - 21:01 euvd

EUVD-2026-25098

Analysis Generated

Apr 22, 2026 - 21:01 vuln.today

CVE Published

Apr 22, 2026 - 20:39 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via POST /api/getUserDetails and POST /api/getLibrary, enabling full read of any table in the database - including app_config, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via node-postgres's simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via COPY ... TO PROGRAM. Under the role shipped by the project's docker-compose.yml (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.

AnalysisAI

SQL injection in Jellystat versions prior to 1.1.10 escalates to remote code execution on the PostgreSQL database host. Authenticated attackers can inject arbitrary SQL via multiple API endpoints (/api/getUserDetails, /api/getLibrary), initially exfiltrating sensitive credentials from the app_config table (including Jellystat admin credentials and Jellyfin API keys). Because the application uses node-postgres simple query protocol allowing stacked queries, attackers can leverage PostgreSQL's COPY ... TO PROGRAM to achieve command execution on the database server. The project's default docker-compose.yml deploys PostgreSQL with superuser privileges, removing any privilege barriers to RCE. Vendor patch released in version 1.1.10 (GitHub commit 735fe7c confirmed). No active exploitation confirmed by CISA KEV, but publicly available exploit code exists given the detailed technical disclosure in GitHub Security Advisory GHSA-fj7c-2p5q-g56m.

Technical ContextAI

Jellystat is a statistics and monitoring dashboard for Jellyfin media servers. The vulnerability stems from unsafe SQL query construction where user-supplied JSON body fields are directly concatenated into SQL strings without parameterization (CWE-89: SQL Injection). The root cause is using node-postgres (pg library) in simple query mode rather than parameterized query mode - when a query is executed without passing a separate parameter array, PostgreSQL accepts multiple semicolon-separated statements (stacked queries). This transforms a typical data-disclosure SQLi into a remote code execution primitive via PostgreSQL's COPY ... TO PROGRAM syntax, which invokes arbitrary shell commands on the database host. The docker-compose.yml configuration documented in the Jellystat repository runs PostgreSQL with the default superuser role, bypassing privilege checks that would otherwise restrict COPY ... TO PROGRAM to administrative roles. CPE cpe:2.3:a:cyfershepard:jellystat identifies CyferShepard as the vendor, affecting all versions below 1.1.10.

RemediationAI

Upgrade immediately to Jellystat version 1.1.10 or later, which contains parameterized query fixes confirmed in GitHub commit 735fe7c6eb0e3e34e92a8a82fd21914d76693665 (https://github.com/CyferShepard/Jellystat/commit/735fe7c6eb0e3e34e92a8a82fd21914d76693665). For installations that cannot upgrade immediately, implement network-level access controls restricting API access to trusted IPs only, and audit PostgreSQL role privileges to revoke superuser status from the application database user (this prevents COPY TO PROGRAM escalation but does not prevent credential disclosure via SELECT injection, so it is a risk-reduction measure, not a full mitigation). Change all credentials stored in the app_config table (Jellystat admin password, Jellyfin API keys) and enable PostgreSQL query logging to detect injection attempts via malformed JSON in POST request bodies to /api/getUserDetails and /api/getLibrary endpoints. Review the vendor security advisory at https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m for additional technical context. Note that restricting database privileges trades off reduced blast radius for potential application functionality degradation if Jellystat legitimately requires elevated PostgreSQL operations.