Read the docs
TI-2026-22315 Aliases CVE-2026-27973

Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers/WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs. The issue is fixed in audiobookshelf-app version 0.12.0-beta, corresponding to audiobookshelf version 2.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Fix Fixed audiobookshelf (advplyr): 2.12.0audiobookshelf-app (advplyr): 0.12.0-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
advplyraudiobookshelfbefore 2.12.02.12.0Patch availableCNA
advplyraudiobookshelf-appbefore 0.12.0-beta0.12.0-betaPatch availableCNA
  • audiobookshelf Vendoradvplyr Affected before 2.12.0 Fixed in 2.12.0 Patch available CNA
  • audiobookshelf-app Vendoradvplyr Affected before 0.12.0-beta Fixed in 0.12.0-beta Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*before 2.12.0Vulnerableadvplyr
cpe:2.3:a:audiobookshelf:audiobookshelf_mobile_app:*:*:*:*:*:*:*:*before 0.12.0Vulnerableadvplyr
  • cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:* Versions before 2.12.0 Vulnerable ·advplyr
  • cpe:2.3:a:audiobookshelf:audiobookshelf_mobile_app:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·advplyr

Remediation

  • Fix · CNA audiobookshelf (advplyr) Fixed in 2.12.0
  • Fix · CNA audiobookshelf-app (advplyr) Fixed in 0.12.0-beta

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27973

References

Patch 2

  • TI-2025-18874 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching CVSS 3.1HIGH 8.2
  • TI-2025-35683 Audiobookshelf vulnerable to OIDC token exfiltration and account takeover CVSS 3.1HIGH 8.8
  • TI-2025-29079 Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload CVSS 4.0MEDIUM 6.9
  • TI-2023-25761 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability CVSS 3.1HIGH 8.1
  • TI-2024-29391 Path Traversal in audiobookshelf CVSS 3.1MEDIUM 6.3
  • TI-2026-22306 Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata CVSS 3.1MEDIUM 4.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences