Read the docs
TI-2026-24405 Aliases CVE-2026-31852

Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

Priority MEDIUM 49CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed code-quality.yml (jellyfin): 109217e75f38394b2f6e46e25dfe5a721203d3c8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jellyfincode-quality.ymlbefore 109217e75f38394b2f6e46e25dfe5a721203d3c8109217e75f38394b2f6e46e25dfe5a721203d3c8Patch availableCNA
  • code-quality.yml Vendorjellyfin Affected before 109217e75f38394b2f6e46e25dfe5a721203d3c8 Fixed in 109217e75f38394b2f6e46e25dfe5a721203d3c8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jellyfin:jellyfin:-:*:*:*:*:*:*:*not specified by NVDVulnerablejellyfin
  • cpe:2.3:a:jellyfin:jellyfin:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·jellyfin

Remediation

  • Fix · CNA code-quality.yml (jellyfin) Fixed in 109217e75f38394b2f6e46e25dfe5a721203d3c8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31852
  2. 2026-10-20 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 1

  • TI-2021-04500 Unauthenticated Arbitrary File Access in Jellyfin CVSS 3.1HIGH 7.7
  • TI-2023-26761 Argument Injection in FFmpeg codec parameters in Jellyfin CVSS 3.1HIGH 8.8
  • TI-2021-10203 Unauthenticated GET requests through Remote Image endpoints CVSS 3.1MEDIUM 5.8
  • TI-2023-09464 In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. CVSS 3.1MEDIUM 5.4
  • TI-2023-09463 In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. CVSS 3.1MEDIUM 5.4
  • TI-2026-27236 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection CVSS 4.0CRITICAL 9.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences