CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast
Attackers can inject malicious scripts into AzuraCast, potentially executing code or hijacking user accounts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-2191?
CVE-2023-2191 is a low-severity cross-site scripting vulnerability in azuracast/azuracast, published on 20 Apr 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
Weakness: CWE-79
Which versions are affected by CVE-2023-2191?
2 open source packages ship an affected version, including azuracast/azuracast. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
azuracast/azuracast Packagist | All versions | 0.18.0 |
azuracast/azuracast Packagist | All versions | 0.18.0 |
Products include Azuracast Azuracast.
How do I fix CVE-2023-2191?
Upgrade azuracast/azuracast to 0.18.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-2191 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2191 exists.
Other vulnerabilities in azuracast/azuracast
- CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload
- CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass
- CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
- CVE-2025-67737 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Sources
Also known as GHSA-q55c-hmpf-6h2g.