GHSA-jwcf-xj6w-xqm5Critical· 9.3▾ MidnightXSS via federated SVG storyboard
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A remote, unauthenticated PeerTube instance can federate a video whose storyboard claims image/png but points at a .svg URL. The federation image pipeline skips the SVG sanitizer the upload path uses, so a raw <script>.
A user must click on a storyboard link (not displayed on the official PeerTube client) to execute the script inside the SVG.
Patched version: 8.3.1
PeerTube < 8.3.1Refer to the advisory for the patched release.