CVE-2023-30627

jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.

• CWE-79

• https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68eePatch
• https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10Release Notes
• https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pqVendor Advisory
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65mExploit, Patch, Vendor Advisory
• https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68eePatch
• https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10Release Notes
• https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pqVendor Advisory
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65mExploit, Patch, Vendor Advisory

Published

Apr 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30621Gipsy is a multi-purpose discord bot which aim to be as modu…9.8
• CVE-2023-30622Clusternet is a general-purpose system for controlling Kuber…8.8
• CVE-2023-30623`embano1/wip` is a GitHub Action written in Bash. Prior to v…8.8
• CVE-2023-30624Wasmtime is a standalone runtime for WebAssembly. Prior to v…8.8
• CVE-2023-30625rudder-server is part of RudderStack, an open source Custome…8.8
• CVE-2023-30626Jellyfin is a free-software media system. Versions starting …8.1
• CVE-2023-30628Kiwi TCMS is an open source test management system. In kiwit…8.8
• CVE-2023-30629Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2023-3063The SP Project & Document Manager plugin for WordPress is vu…8.8
• CVE-2023-30630Dmidecode before 3.5 allows -dump-bin to overwrite a local f…7.1
• CVE-2023-30631Improper Input Validation vulnerability in Apache Software F…7.5
• CVE-2023-30633An issue was discovered in TrEEConfigDriver in Insyde Insyde…5.3