Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-57167PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Medium 5.1

In plain English

A medium-severity security flaw in PeerTube from Chocobozzz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 59.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.

Affected products (as reported)

Vendor	Product	Versions
Chocobozzz	PeerTube	< 8.2.2

Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28 x_refsource_CONFIRM
https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3 x_refsource_MISC
https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 x_refsource_MISC