CVE-2025-54423: copyparty DOM-Based XSS Vulnerability in Multimedia Metadata Rendering
Summary
CVE-2025-54423: copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata. Affects copyparty versions < 1.18.5. Fixed in 1.18.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
copyparty is an open-source file-sharing application that allows users to share and stream multimedia content over the web. It supports various file formats and provides a user-friendly interface for managing and accessing shared files. However, it has a vulnerability that arises from improper sanitization of multimedia tags, particularly in music files like m3u, which can lead to security risks for users.
Vulnerability Detail
The vulnerability stems from the lack of proper sanitization of multimedia metadata rendered in the web application. An unauthenticated attacker can exploit this flaw to execute arbitrary JavaScript code in a victim's browser. This can occur in two scenarios: a user with upload permissions can upload a malicious song file containing unsanitized metadata, or an unauthenticated user can trick another user into clicking a malicious URL that points to an externally-hosted m3u file. The potential ramifications include unauthorized access to user data and the execution of harmful scripts in the context of the victim's browser.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.5
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.18.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid clicking on untrusted links that may lead to malicious m3u files until the package is updated. Additionally, users with upload permissions should ensure that any multimedia files uploaded do not contain unsanitized metadata.
Conclusion
The copyparty application has a significant DOM-Based XSS vulnerability due to improper sanitization of multimedia metadata, which can lead to arbitrary code execution in users' browsers. It is crucial for users to update to the patched version to mitigate this risk and to be cautious with untrusted links in the meantime.
See every vulnerability recorded for copyparty →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability primarily affects multimedia files, especially m3u files, due to improper sanitization of metadata.
Yes, the vulnerability has been patched in version 1.18.5 of the copyparty package. Users should upgrade to this version or later.
If you cannot update the package immediately, avoid clicking on untrusted links and ensure that any uploaded multimedia files do not contain unsanitized metadata.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
