PT-2026-57239 · Peertube · Peertube

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-57167

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions PeerTube versions prior to 8.2.2

Description Server-side-rendered video watch pages embed a schema.org JSON-LD block by processing video metadata through JSON.stringify without escaping less-than, greater-than, or slash characters. This allows an attacker to use a byte sequence that closes a script element to inject arbitrary HTML or JavaScript, which then executes in the instance origin when visitors view the attacker's videos.

Recommendations Update to version 8.2.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-57167

GHSA-JXWQ-H9XV-HR28

Affected Products

Peertube

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57167.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-57167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-57167 · Security Note
• https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28 · Note
• https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3 · Note
• https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 · Note