CVE-2026-27963: Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27963?
The severity of CVE-2026-27963 is classified as high due to its potential for stored XSS attacks.
How do I fix CVE-2026-27963?
To fix CVE-2026-27963, upgrade your Audiobookshelf application to version 2.32.0 or later.
What versions of Audiobookshelf are affected by CVE-2026-27963?
CVE-2026-27963 affects all versions of Audiobookshelf prior to 2.32.0.
What kind of attacks can CVE-2026-27963 enable?
CVE-2026-27963 enables stored cross-site scripting (XSS) attacks, allowing arbitrary JavaScript execution.
Are there any mitigations for CVE-2026-27963 if I cannot upgrade?
If you cannot upgrade, consider input validation and output encoding measures to mitigate the risk of XSS.