CVE-2023-23636: 
JavaScript vulnerability analysis and mitigation

In Jellyfin versions 10.8.x through 10.8.3, a stored Cross-Site Scripting (XSS) vulnerability was discovered in the playlist name functionality. The vulnerability was identified with CVE-2023-23636 and was reported by Christian Pöschl of usd AG. The issue was first reported on July 18, 2022, and was fixed by the vendor on August 16, 2022 (USD Advisory).

The vulnerability exists in the playlist name functionality where user input is not properly sanitized before being displayed. This allows attackers to inject malicious JavaScript code that gets stored and executed whenever a user visits the playlist page. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to steal access tokens stored in the localStorage of victim users. Since these tokens grant access to user accounts, successful exploitation could lead to complete account takeover. This is particularly severe when high-privileged users access a playlist containing malicious code (USD Advisory).

The vulnerability has been fixed in subsequent releases. The recommended security practice is to treat all input on the website as potentially dangerous and ensure all output that is dynamically generated based on user-controlled data is properly encoded according to its context (USD Advisory).