Tautulli stores a newsletter cron value in the databases newsletter table without proper JSON encoding, allowing an attacker with API or administrator privileges to inject arbitrary JavaScript. When an administrator later opens the newsletter configuration modal, the malformed cron is executed in the web context, enabling the attacker to run arbitrary scripts in the client’s browser session. The injected code persists in the database and can be executed repeatedly, even after user credential rotation, until the value is explicitly removed. The defined CVSS score of 4.8 marks the vulnerability as moderate in severity. Based on the description, the impact is confined to client‑side script execution and potential data exfiltration or session hijacking within a Tautulli web session.

The affected product is Tautulli, a Python based monitoring tool for Plex Media Server. Versions prior to 2.17.2 are vulnerable. Users running 2.17.1 or earlier should be aware that any stored newsletter cron value may contain malicious scripts. The vulnerability was discovered in the Tautulli Tautulli project and was addressed in the 2.17.2 release.

The CVSS score of 4.8 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying limited public exploitation. The likely attack vector requires the attacker to possess an API key or administrator privileges to write a crafted cron value, and an administrator user must later open the newsletter configuration modal to trigger execution. Thus, while the vulnerability can lead to arbitrary script execution, it is limited to privileged users and requires a specific user interaction to activate.