Jellystat, an open-source statistics app for Jellyfin, has a critical SQL injection vulnerability (CVE-2026-41167) in versions before 1.1.10. Multiple API endpoints build SQL queries by directly interpolating unsanitized request-body fields into raw SQL strings. This flaw allows an authenticated user to inject arbitrary SQL commands via POST requests to /api/getUserDetails and /api/getLibrary. Due to the use of node-postgres's simple query protocol without parameterization, stacked queries are permitted, enabling escalation from data disclosure to arbitrary command execution on the PostgreSQL server using the COPY ... TO PROGRAM feature. The default PostgreSQL role in the provided docker-compose.yml is a superuser, so no privilege escalation is needed to achieve remote code execution. The vulnerability is fixed in version 1.1.10.

An authenticated attacker can exploit this vulnerability to fully read any database table, including sensitive data such as admin credentials and API keys. Furthermore, the attacker can execute arbitrary commands on the PostgreSQL host, leading to full system compromise. The vulnerability is critical with a CVSS 3.1 score of 9.1, reflecting high impact on confidentiality, integrity, and availability.

Version 1.1.10 of Jellystat contains a fix for this vulnerability. Users should upgrade to version 1.1.10 or later to remediate this issue. No official patch or workaround is indicated beyond upgrading. Since this is not a cloud service, remediation depends on user action to update the software.