A stored cross‑site scripting flaw exists in older releases of the Audiobookshelf mobile app that permits an attacker to embed malicious JavaScript into the metadata of an audio library or podcast feed. When a victim opens the altered item, the app’s WebView executes the payload, enabling arbitrary code execution on the device. Consequently, attackers can hijack the user’s session, exfiltrate personal data, or maliciously invoke native device APIs. The affected code paths fall under CWE‑79, a classic reflected or stored XSS weakness.

The vulnerability is present in versions of the Audiobookshelf mobile application released before 0.12.0‑beta. The affected product is the self‑hosted Audiobookshelf‑Mobile‑App, maintained by advplyr. Users running earlier versions and exposing library‑modification rights or consuming unsecured podcast RSS feeds are at risk.

The CVSS base score of 4.8 indicates a low‑medium severity, and the EPSS score of less than 1% suggests the likelihood of real‑world exploitation is very low at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to gain the ability to modify library metadata or supply a malicious RSS feed; the attacker then relies on victim interaction with the affected content. If successful, the attacker can execute arbitrary code inside the app’s embedded WebView, potentially compromising the device’s security posture.