CyberRota Analysis
AI-GeneratedPrior to version 8.2.2, PeerTube's server-side-rendered video watch pages improperly handled JSON-LD metadata, allowing attackers to inject arbitrary HTML or JavaScript into the page. This vulnerability can lead to cross-site scripting (XSS) attacks, potentially compromising the security of users who visit the affected videos. Organizations using PeerTube should prioritize upgrading to version 8.2.2 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence that closes a script element to inject arbitrary HTML or JavaScript that executes in the instance origin for visitors to the attacker's videos. This issue is fixed in version 8.2.2.