CVE-2026-27973: Audiobookshelf Stored XSS Vulnerability

CVE-2026-27973 Overview

A stored cross-site scripting (XSS) vulnerability has been identified in Audiobookshelf, a self-hosted audiobook and podcast server. This vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application and allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers or WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs.

Critical Impact

Attackers can inject malicious JavaScript through library metadata, enabling session hijacking, sensitive data theft, and potential access to native device APIs on mobile devices running the Audiobookshelf app.

Affected Products

• Audiobookshelf Mobile App versions prior to 0.12.0-beta
• Audiobookshelf Server versions prior to 2.12.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27973 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27973

Vulnerability Analysis

This stored XSS vulnerability stems from improper input sanitization in the Audiobookshelf mobile application's search card component. The application renders user-controlled library metadata directly into the DOM using Vue.js's v-html directive without proper sanitization. This allows attackers with library modification privileges to inject malicious JavaScript payloads that execute in the context of other users' sessions.

The vulnerability requires network access and user interaction to exploit, as victims must view the maliciously crafted library items. However, once triggered, the XSS payload can access the same origin's cookies, session tokens, and potentially interact with native device APIs through the WebView context on mobile devices.

Root Cause

The root cause is the use of Vue.js's v-html directive to render unsanitized user-supplied metadata in the ItemSearchCard.vue component. The vulnerable code directly interpolates matchHtml content derived from library metadata (including title, subtitle, authors, series, tags, ISBN, ASIN, episode, and narrators fields) into the rendered HTML without proper encoding or sanitization. This violates secure coding practices for handling untrusted input in web applications.

Attack Vector

The attack vector involves an authenticated user with library modification privileges inserting malicious JavaScript into library item metadata fields. When other users search for or view these items in the mobile application, the malicious payload executes in their browser/WebView context. The attack exploits the trust relationship between the application and its users, as library metadata is typically considered safe content.

// Vulnerable code pattern (from ItemSearchCard.vue)
// The v-html directive renders unsanitized user content directly into the DOM

<template>
  <div class="flex h-full px-1 overflow-hidden">
    <covers-book-cover :library-item="libraryItem" :width="coverWidth" :book-cover-aspect-ratio="bookCoverAspectRatio" />
-    <div class="flex-grow px-2 audiobookSearchCardContent">
-      <p v-if="matchKey !== 'title'" class="truncate text-sm">{{ title }}</p>
-      <p v-else class="truncate text-sm" v-html="matchHtml" />
-
-      <p v-if="matchKey === 'subtitle'" class="truncate text-xs text-fg-muted">{{ matchHtml }}</p>
-
-      <p v-if="matchKey !== 'authors'" class="text-xs text-fg truncate">by {{ authorName }}</p>
-      <p v-else class="truncate text-xs text-fg" v-html="matchHtml" />
-
-      <div v-if="matchKey === 'series' || matchKey === 'tags' || matchKey === 'isbn' || matchKey === 'asin' || matchKey === 'episode' || matchKey === 'narrators'" class="m-0 p-0 truncate text-xs" v-html="matchHtml" />
+    <div class="grow px-2 audiobookSearchCardContent">
+      <p class="truncate text-sm">{{ title }}</p>
+      <p v-if="subtitle" class="truncate text-xs text-gray-300">{{ subtitle }}</p>
+      <p class="text-xs text-gray-200 truncate">{{ $getString('LabelByAuthor', [authorName]) }}</p>
    </div>
  </div>
</template>

Source: GitHub Commit Details

Detection Methods for CVE-2026-27973

Indicators of Compromise

• Library metadata fields containing JavaScript code, HTML script tags, or event handlers (e.g., <script>, onerror=, onload=)
• Unexpected outbound network requests from user sessions to external domains
• Unusual session activity patterns indicating potential session hijacking
• Browser console errors or warnings related to cross-origin script execution

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Monitor application logs for suspicious metadata modifications containing HTML or JavaScript patterns
• Deploy web application firewalls (WAF) to detect XSS payload patterns in API requests
• Audit library item metadata for potentially malicious content using automated scanning tools

Monitoring Recommendations

• Enable detailed logging for library metadata modification operations
• Configure alerts for session anomalies that may indicate token theft or hijacking
• Monitor for unusual patterns in search query behavior that may indicate exploitation attempts
• Review WebView JavaScript bridge access patterns on mobile applications

How to Mitigate CVE-2026-27973

Immediate Actions Required

• Upgrade Audiobookshelf mobile app to version 0.12.0-beta or later
• Upgrade Audiobookshelf server to version 2.12.0 or later
• Audit existing library metadata for potentially malicious content
• Review and restrict library modification privileges to trusted users only
• Invalidate existing user sessions as a precautionary measure

Patch Information

The vulnerability has been addressed in audiobookshelf-app version 0.12.0-beta, corresponding to audiobookshelf server version 2.12.0. The fix removes the use of v-html directives for rendering user-controlled metadata and replaces them with safe text interpolation using Vue.js's double-curly-brace syntax, which automatically HTML-encodes output.

The security patch is available via the GitHub commit. Additional details can be found in the GitHub Security Advisory.

Workarounds

• Restrict library modification privileges to only highly trusted administrators
• Implement input validation on metadata fields at the server level to reject HTML/JavaScript content
• Deploy a Content Security Policy (CSP) that blocks inline script execution
• Consider temporarily disabling the search functionality if immediate patching is not possible

# Configuration example - Implementing CSP headers (nginx)
# Add to your nginx server configuration for the Audiobookshelf proxy

location / {
    # Block inline scripts to mitigate XSS attacks
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';" always;
    
    proxy_pass http://localhost:13378;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}