CVE-2021-3780: Cross-site Scripting in peertube
Summary
CVE-2021-3780: Cross-site Scripting in peertube. Affects peertube versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
peertube is an npm package that provides a platform for hosting and sharing videos. It allows users to upload, view, and interact with videos in a decentralized manner. The package is vulnerable to a Cross-site Scripting (XSS) attack, which occurs when user-supplied input is not properly sanitized and is rendered as part of a web page. This vulnerability allows an attacker to inject malicious code into the page, potentially leading to session hijacking and unauthorized access to user data.
Vulnerability Detail
The vulnerability in peertube arises from improper neutralization of input during web page generation. An attacker can exploit this by uploading a specially crafted SVG image and then sharing the URL of that image with other users. When the targeted users open the link, the malicious code embedded in the SVG image executes in their browsers, allowing the attacker to steal their complete session keys. These session keys are stored in local storage and can be easily accessed by the attacker using JavaScript. The impact of this vulnerability can be significant, as it compromises the security and privacy of affected users.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
npm install peertube@3.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install peertube@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of SVG images in peertube until the package is updated to a fixed version. This can be done by modifying the configuration settings or by implementing server-side filtering of SVG images to prevent their upload and rendering. However, it is strongly advised to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
The Cross-site Scripting vulnerability in peertube can lead to session hijacking and unauthorized access to user data. It is crucial to upgrade to the latest version of peertube (3.4.0 or later) to mitigate this vulnerability. Additionally, disabling the use of SVG images can serve as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for peertube →
FAQ
peertube is an npm package that provides a decentralized video hosting and sharing platform.
The vulnerability allows an attacker to steal session keys and potentially gain unauthorized access to user data.
Upgrade to peertube version 3.4.0 or later to fix the vulnerability.
As a temporary workaround, users can disable the use of SVG images in peertube.
For more information, you can visit the advisory page on GitHub: [link to advisory]
