CVE-2026-38466: n/a

This vulnerability is a stored XSS in GazellePW's torrent remaster custom title feature. Authenticated users can supply malicious JavaScript through the remaster_custom_title parameter when uploading or editing a torrent. The malicious script is stored and later executed in the context of users viewing the torrent title, leading to potential information disclosure or session hijacking. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality and integrity but no impact on availability.

Exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary JavaScript in the context of other users viewing the affected torrent titles. This may lead to theft of sensitive information, session hijacking, or other client-side attacks. There is no indication of impact on system availability. The attack requires authentication and user interaction to trigger the malicious script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with torrent titles and restrict upload/edit permissions to trusted users. Implementing input validation and output encoding on the remaster_custom_title parameter can mitigate the risk.