EUVD-2026-42952Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires low-privilege upload account (PR:L) and victim page visit (UI:R); scope changes to browser context with limited confidentiality and integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.
AnalysisAI
Stored XSS in PeerTube before version 8.2.2 allows any authenticated uploader to inject arbitrary HTML and JavaScript into the instance origin by embedding the byte sequence </script> inside video metadata fields. The server-side renderer serializes video metadata directly into schema.org JSON-LD script blocks using JSON.stringify without HTML-character escaping, causing the browser to terminate the script tag prematurely and parse attacker-controlled content as raw HTML. The payload executes automatically for every visitor to the affected video's watch page, and no public exploit has been identified at time of analysis.
Technical ContextAI
PeerTube is an open-source, ActivityPub-federated video hosting platform (CPE: cpe:2.3:a:chocobozzz:peertube:*:*:*:*:*:*:*:*). Its server-side rendering pipeline embeds structured metadata on video watch pages using the schema.org JSON-LD format inside a <script type="application/ld+json"> HTML element. The platform serializes video metadata (title, description, and related fields) via JavaScript's native JSON.stringify(), which produces valid JSON but does not escape the characters <, >, or / - characters that are semantically significant in HTML parsing. When a metadata value contains the literal string </script>, the browser's HTML parser closes the enclosing script tag at that point, treating any trailing content as raw HTML. This is a textbook instance of CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS), where user-controlled data is injected into a script context without adequate output encoding. The fix, introduced in commit 45394d701b08e87d72b8f0c1866b881f2becbde3, applies proper HTML-character escaping to the JSON-LD serialization path.
RemediationAI
Upgrade to PeerTube 8.2.2 or later immediately; the patched release is available at https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 and addresses the root cause by adding proper HTML-character escaping to the JSON-LD metadata serialization path (commit 45394d701b08e87d72b8f0c1866b881f2becbde3). If an immediate upgrade is not feasible, restrict video upload and account registration to trusted users only via the instance administration panel - this reduces the attacker pool but does not eliminate the vulnerability for already-uploaded content and does not protect against compromise of existing trusted accounts. As an additional interim step, administrators should audit existing video metadata for fields containing the string </script> and remove or sanitize any such entries. No configuration-only workaround fully mitigates the rendering flaw; patching is the only complete remediation.
The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send request
This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite lo
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when ex
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.
Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1. Rated medium severity
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated me
Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. Rated medium severity (CVSS 5.4), this
Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0. Rated medium severity (CVSS 5.4), this vu
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. Ra
The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. Ra
The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today