CVE-2026-41167

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41167

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41167.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41167

Aliases

GHSA-fj7c-2p5q-g56m

Published

2026-04-22T20:39:31.044Z

Modified

2026-07-08T08:11:24.507687313Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Jellystat has SQL Injection that leads to to Remote Code Execution

Details

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via POST /api/getUserDetails and POST /api/getLibrary, enabling full read of any table in the database - including app_config, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via node-postgres's simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via COPY ... TO PROGRAM. Under the role shipped by the project's docker-compose.yml (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41167.json",
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/cyfershepard/jellystat

Affected ranges

Type

GIT

Repo

https://github.com/cyfershepard/jellystat

Events

Introduced

Fixed

735fe7c6eb0e3e34e92a8a82fd21914d76693665

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.10"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.9

V1.*

V1.1.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41167.json"