PeerTube’s server‑side rendering of video watch pages embeds a JSON‑LD block that is built by JSON.stringify’ing video metadata without escaping characters that could close a script element. This allows an attacker who controls a video to inject arbitrary HTML or JavaScript that runs in the instance origin for any visitor to the attacker’s videos, potentially compromising the integrity of the platform for all visitors. The weakness is a classic input handling flaw, categorized as CWE‑80.

This vulnerability affects the open‑source PeerTube platform distributed by Chocobozzz. All releases prior to version 8.2.2. Upgrading to 8.2.2 or later is recommended.

The CVSS assessment gives a score of 5.1, indicating moderate severity. The EPSS score is reported as < 1 %, suggesting a low current exploitation probability. The vulnerability is not listed in the catalog. Exploitation requires only that an attacker host a video on the instance with malicious metadata; no additional authentication or privilege is needed. Once an attacker’s video is played, the injected script executes with the privileges of the instance origin, providing a complete cross‑site scripting vector for all users who view the content.