A stored XSS flaw in the Audiobookshelf mobile client allows an attacker who can modify a library to inject arbitrary JavaScript via audiobook metadata. This code runs in the context of the WebView that renders search results, giving the attacker the same privileges as the user. Successful exploitation could lead to session hijacking, data exfiltration, and unauthorized calls to native device APIs such as microphone or filesystem, as stated.

The flaw exists in the Audiobookshelf mobile application and server versions earlier than 0.12.0-beta (app) and 2.12.0 (server). The affected products are the open‑source Audiobookshelf server and its companion mobile app, both provided by advplyr. Users running the mobile app before the 0.12.0-beta release or the server before 2.12.0 are vulnerable. Those who own the app and server with the listed versions, especially if they allow library modification, are impacted.

The CVSS score is 4, indicating moderate severity. The EPSS is below 1 %, implying a low but nonzero likelihood of exploitation. It is not listed in the CISA KEV catalog, so no confirmed exploitation documented. Attackers need the ability to modify library metadata, so the vulnerability requires authenticated privileges; once an attacker has those, the exploit is straightforward and does not require advanced techniques. The risk is moderate with a relatively low exploitation probability.