PeerTube, an ActivityPub‑federated video platform, contains a flaw in the ActorFollowModel.updateScore() method. Before version 8.1.6 the method concatenates the actor’s inboxUrl supplied by a remote server directly into an SQL statement. This allows an attacker to inject arbitrary SQL commands, which is a classic CWE‑89 SQL injection. The ability to run injected SQL enables reading sensitive data such as OAuth access tokens and modifying database records, potentially allowing the attacker to hijack administrator accounts or otherwise compromise the system.

The affected software is PeerTube from the vendor Chocobozzz, versions prior to 8.1.6. Vulnerable instances are any PeerTube deployments that have not applied the patch released in 8.1.6, which contains the fix that sanitizes the inboxUrl parameter. Later releases such as 8.1.8 also include the patch.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score is less than 1 %, indicating a low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Nevertheless, the vulnerability is exploitable by an unauthenticated remote server that can communicate using ActivityPub. Attackers could leverage the injection to read or modify arbitrary database content and hijack administrator accounts.