CVE-2026-57167: PeerTube XSS Vulnerability

CVE-2026-57167 Overview

CVE-2026-57167 is a stored cross-site scripting (XSS) vulnerability in PeerTube, an ActivityPub-federated video streaming platform. Versions prior to 8.2.2 render video watch pages server-side and embed a schema.org JSON-LD block that serializes video metadata using JSON.stringify without escaping <, >, or / characters. An attacker who controls video metadata can inject a closing </script> sequence followed by arbitrary HTML or JavaScript. The injected payload executes in the origin of the PeerTube instance whenever a visitor loads the attacker's video page. The issue is fixed in PeerTube 8.2.2.

Critical Impact
Authenticated users who can upload videos can execute JavaScript in the instance origin against any visitor of their video pages, enabling session theft and account takeover.

Affected Products

PeerTube versions prior to 8.2.2
Self-hosted PeerTube instances federated via ActivityPub
Any PeerTube deployment relying on server-side-rendered video watch pages

Discovery Timeline

2026-07-10 - CVE-2026-57167 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-57167

Vulnerability Analysis

PeerTube renders video watch pages on the server and embeds a schema.org JSON-LD block inside a <script type="application/ld+json"> element. The server generates this block by calling JSON.stringify on video metadata such as titles, descriptions, and tags. While JSON.stringify escapes quotes and backslashes, it does not escape <, >, or /. An attacker who submits a video with metadata containing the byte sequence </script> can prematurely terminate the enclosing script tag. The bytes that follow are parsed as HTML, allowing injection of new <script> blocks or event-handler-bearing elements. The classification maps to [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Root Cause

The root cause is unsafe serialization of untrusted user input into an HTML script context. JSON.stringify is a JSON encoder, not an HTML encoder. When its output is placed directly into a script element, unescaped < characters can break out of the script context. The patch introduces an escapeHtmlJSONStr helper in @peertube/peertube-core-utils and applies it in server/core/lib/html/shared/page-html.ts before injecting configuration and metadata into HTML.

Attack Vector

Exploitation requires an authenticated PeerTube account with permission to upload videos or edit video metadata. The attacker crafts a video field containing </script> followed by an HTML payload, then shares the video URL. Any user who visits the watch page executes the payload in the instance origin, exposing session cookies, CSRF tokens, and any DOM-accessible data.

typescript

// Patch: server/core/lib/html/shared/page-html.ts
-import { AVAILABLE_LOCALES, buildFileLocale, escapeHTML, getDefaultLocale, is18nLocale } from '@peertube/peertube-core-utils'
+import {
+  AVAILABLE_LOCALES,
+  buildFileLocale,
+  escapeHTML,
+  escapeHtmlJSONStr,
+  getDefaultLocale,
+  is18nLocale
+} from '@peertube/peertube-core-utils'
 import { HTMLServerConfig } from '@peertube/peertube-models'
 import { isTestOrDevInstance, root, sha256 } from '@peertube/peertube-node-utils'
 import { setClientLanguageCookie } from '@server/helpers/i18n.js'

Source: PeerTube Commit 45394d7 — the fix routes stringified JSON through escapeHtmlJSONStr before injecting it into HTML.

Detection Methods for CVE-2026-57167

Indicators of Compromise

Video titles, descriptions, or tags containing the literal string </script> or encoded variants such as <\/script>.
Unexpected outbound requests from browsers viewing watch pages to attacker-controlled domains.
Video watch page HTML where the application/ld+json script block contains raw < or > characters inside string values.
Session cookie or token access anomalies from clients that recently viewed federated PeerTube video pages.

Detection Strategies

Query the PeerTube database for video metadata fields containing <, >, or /script substrings.
Fetch server-rendered watch page HTML and validate that the JSON-LD block parses as JSON without prematurely closing the script element.
Deploy a Content Security Policy in report-only mode and monitor script-src violations originating from watch pages.

Monitoring Recommendations

Log and review all video upload and edit events, correlating uploader identity with metadata contents.
Alert on federated video ingest from remote instances where metadata contains HTML control characters.
Monitor web server logs for repeated requests to watch pages associated with newly uploaded videos from low-reputation accounts.

How to Mitigate CVE-2026-57167

Immediate Actions Required

Upgrade all PeerTube instances to version 8.2.2 or later without delay.
Audit existing video metadata for injection payloads and quarantine suspect entries before upgrade.
Rotate administrator and moderator session tokens after patching in case active exploitation occurred.
Review recent uploads from newly registered accounts and federated peers for suspicious content.

Patch Information

The fix is available in PeerTube release v8.2.2. Details are documented in GitHub Security Advisory GHSA-jxwq-h9xv-hr28. The corrective commit adds the escapeHtmlJSONStr utility and applies it in server/core/lib/html/shared/page-html.ts when serializing configuration and metadata into HTML.

Workarounds

Restrict video upload permissions to trusted users until the upgrade is applied.
Disable server-side rendering of the schema.org JSON-LD block via reverse-proxy content rewriting where feasible.
Enforce a strict Content Security Policy that forbids inline scripts and unknown external script-src origins.
Temporarily suspend ActivityPub federation with untrusted remote instances to block malicious inbound video metadata.

bash

# Upgrade PeerTube to the patched release
cd /var/www/peertube
sudo -u peertube git fetch origin
sudo -u peertube git checkout v8.2.2
sudo -u peertube yarn install --production --pure-lockfile
sudo systemctl restart peertube