CVE-2023-23635 Jellyfin Web Cross-Site Scripting (XSS) via Collection Name

What is CVE-2023-23635?

CVE-2023-23635 is a medium-severity cross-site scripting vulnerability in n/a, published on 3 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

Weakness: CWE-79

Which versions are affected by CVE-2023-23635?

2 open source packages ship an affected version, including jellyfin-web. It affects 1 product.

Products include Jellyfin Jellyfin.

How do I fix CVE-2023-23635?

Upgrade jellyfin-web to 10.8.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-23635 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23635 exists.

Other vulnerabilities in n/a

• CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain Critical 10.0
• CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation Critical 10.0
• CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection Critical 9.3
• CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js Critical 9.1
• CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-749c-pc87-4qcw.