PeerTube’s server‑side rendering of video watch pages includes a JSON‑LD block created from video metadata by using JSON.stringify. The implementation fails to escape characters such as <, >, or / This flaw lets an attacker embed a closing script tag in a video’s metadata, turning the JSON‑LD block into a <script> element. When a user views the attacker's video, the injected script runs with the instance origin, allowing arbitrary JavaScript execution in the browser context of all visitors.

The vulnerable code is present in the Chocobozzz:PeerTube platform in every release prior to 8.2.2. The issue is fixed starting with version 8.2.2. All instances running those earlier releases are affected.

The CVSS score of 5.1 classifies the vulnerability as moderate in severity. The EPSS score of < 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker does not need additional privileges beyond having the ability to upload a video; the weakness is exploitable through user‑supplied metadata alone.