Tautulli’s /search endpoint inserts an untrusted query parameter directly into a JavaScript string without full escape of backslashes. The input can contain a backslash‑quote sequence that terminates the string, allowing an attacker to inject arbitrary JavaScript that runs in the victim’s browser when the constructed page loads. This reflected XSS can be used to steal session cookies, manipulate the user’s view of the Tautulli interface, or perform other malicious actions within the authenticated user’s session.

The vulnerability exists in all releases of Tautulli prior to version 2.17.2. Any instance that exposes the /search endpoint and serves JSON in the data/interfaces/default/search.html template is affected.

The CVSS score of 5.1 indicates a moderate severity. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the probability of widespread exploitation is considered low at present. The likely attack vector is remote, with an attacker sending a crafted link to an authenticated user; once the user follows the link, the injected script executes in the web context. The impact is confined to the browser session of the victim and does not grant direct server‑side code execution.