CVE-2026-27973: Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the…

PriorityP421medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.16%

6.0th percentile

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobookshelf mobile application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers/WebViews, potentially leading to session hijacking, data exfiltration, and unauthorized access to native device APIs. The issue is fixed in audiobookshelf-app version 0.12.0-beta, corresponding to audiobookshelf version 2.12.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
advplyr	audiobookshelf	< 2.12.0	2.12.0
advplyr	audiobookshelf-app	< 0.12.0-beta	0.12.0-beta
audiobookshelf	audiobookshelf	< 2.12.0	2.12.0
audiobookshelf	audiobookshelf_mobile_app	< 0.12.0	0.12.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.