---
id: GHSA-jwcf-xj6w-xqm5
title: XSS via federated SVG storyboard
summary: XSS via federated SVG storyboard
severity: critical
cvss: 9.3
vendor: PeerTube
product: PeerTube
affected:
  - PeerTube < 8.3.1
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T07:50:31Z'
source: GHSA
sourceUrl: 'https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jwcf-xj6w-xqm5'
references:
  - url: >-
      https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jwcf-xj6w-xqm5
tags:
  - ghsa
ingestedAt: '2026-10-27T18:33:01.456Z'
ecosystem: Chocobozzz
---

## Overview

A remote, unauthenticated PeerTube instance can federate a video whose storyboard claims image/png but points at a .svg URL. The federation image pipeline skips the SVG sanitizer the upload path uses, so a raw <script>.

A user must click on a storyboard link (not displayed on the official PeerTube client) to execute the script inside the SVG.

Patched version: 8.3.1

## Affected packages

- `PeerTube < 8.3.1`

## Remediation

Refer to the advisory for the patched release.