Read the docs
TI-2026-41136 Aliases CVE-2026-57167

PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Priority LOW 24CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed PeerTube (Chocobozzz): 8.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chocobozzzPeerTubebefore 8.2.28.2.2Patch availableCNA
  • PeerTube Vendorchocobozzz Affected before 8.2.2 Fixed in 8.2.2 Patch available CNA

Remediation

  • Fix · CNA PeerTube (Chocobozzz) Fixed in 8.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57167

References

Other 3

  • TI-2025-23959 PeerTube ActivityPub Playlist Creation Blind SSRF and DoS CVSS 3.1HIGH 7.5
  • TI-2025-23958 PeerTube ActivityPub Crawl Infinite Loop DoS CVSS 3.1HIGH 7.5
  • TI-2025-23957 PeerTube Arbitrary Playlist Creation via ActivityPub Protocol CVSS 3.1MEDIUM 5.3
  • TI-2025-23960 PeerTube User Import Authenticated Resource Exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2025-23955 PeerTube User Import Authenticated Persistent Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2025-23956 PeerTube Arbitrary Playlist Creation via REST API CVSS 3.1MEDIUM 4.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences