CVE-2026-27974Disclosure(audiobookshelf / audiobookshelf_mobile_app)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges (or control over a malicious podcast RSS feed) can execute code in victim users' WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs. audiobookshelf-app version 0.12.0-beta fixes the issue.

audiobookshelf CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/advplyr/audiobookshelf-app/commit/bab95530c8c3d7a4b4cec5b059da8b79ad50223e

Vendor / third-party advisories

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-8c9r-pvrj-vcf5

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

audiobookshelf_mobile_app

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-02-26); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

audiobookshelf

Products

audiobookshelf_mobile_app

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-26	3	Disclosure3
2026-03-13	1	Disclosure1

Full discourse4 posts

DailyCVE@dailycve211d
Disclosure
🟠 Audiobookshelf Mobile App, Cross-Site Scripting (XSS), #CVE-2026-27974 (Medium) https://dailycve.com/audiobookshelf-mobile-app-cross-site-scripting-xss-cve-2026-27974-medium/
Post summary
The text announces a Cross‑Site Scripting vulnerability (CVE‑2026‑27974) in the Audiobookshelf Mobile App and directs readers to a DailyCVE article with further details.
0000031
168 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-27974 Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf… https://www.cve.org/CVERecord?id=CVE-2026-27974
Post summary
The text announces a cross‑site scripting vulnerability (CVE‑2026‑27974) affecting Audiobookshelf versions before 0.12.0‑beta.
00000114
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds226d
Disclosure
CVE-2026-27974 Cross-Site Scripting in Audiobookshelf Mobile App Before ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27974 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A Cross‑Site Scripting vulnerability (CVE‑2026‑27974) was disclosed for the Audiobookshelf mobile app, with a link to details but no PoC, exploit code, or patch information provided.
0000040
4.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash226d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-27974 - Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player) Intel Report: https://ift.tt/QY2venp
Post summary
A new CVE-2026-27974 is disclosed, describing a stored XSS flaw in the Audiobooksheld mobile app’s WrappingMarquee.js triggered by audiobook metadata, with an Intel report linked for further details.
0000016
338 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	audiobookshelf	audiobookshelf_mobile_app	-	-	-

Explore more

Back to dashboard audiobookshelf CVEs audiobookshelf_mobile_app vulnerabilities

What researchers are saying

CVE-2026-27974

DailyCVE@dailycveDisclosure

The text announces a Cross‑Site Scripting vulnerability (CVE‑2026‑27974) in the Audiobookshelf Mobile App and directs readers to a DailyCVE article with further details.

CVE@CVEnewDisclosure

The text announces a cross‑site scripting vulnerability (CVE‑2026‑27974) affecting Audiobookshelf versions before 0.12.0‑beta.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A Cross‑Site Scripting vulnerability (CVE‑2026‑27974) was disclosed for the Audiobookshelf mobile app, with a link to details but no PoC, exploit code, or patch information provided.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A new CVE-2026-27974 is disclosed, describing a stored XSS flaw in the Audiobooksheld mobile app’s WrappingMarquee.js triggered by audiobook metadata, with an Intel report linked for further details.