Read the docs
TI-2026-22316 Aliases CVE-2026-27974

Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player)

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges (or control over a malicious podcast RSS feed) can execute code in victim users' WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs. audiobookshelf-app version 0.12.0-beta fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed audiobookshelf-app (advplyr): 0.12.0-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
advplyraudiobookshelf-appbefore 0.12.0-beta0.12.0-betaPatch availableCNA
  • audiobookshelf-app Vendoradvplyr Affected before 0.12.0-beta Fixed in 0.12.0-beta Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:audiobookshelf:audiobookshelf_mobile_app:*:*:*:*:*:*:*:*before 0.12.0Vulnerableadvplyr
  • cpe:2.3:a:audiobookshelf:audiobookshelf_mobile_app:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·advplyr

Remediation

  • Fix · CNA audiobookshelf-app (advplyr) Fixed in 0.12.0-beta

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27974

References

Patch 1

Advisory 1

  • TI-2026-22315 Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App) CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences