CVE-2026-57167 is a medium severity vulnerability in Chocobozzz PeerTube, an ActivityPub-federated video streaming platform. The issue arises because server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters. This improper neutralization of script-related HTML tags (CWE-80) allows an attacker to inject arbitrary HTML or JavaScript by including a byte sequence that closes a script element in the video metadata. This malicious code executes in the origin context of the PeerTube instance for visitors watching the attacker's videos. The vulnerability affects all versions prior to 8.2.2 and is resolved in version 8.2.2.

An attacker can execute arbitrary JavaScript in the security context of the PeerTube instance by crafting video metadata that injects malicious code. This can lead to typical XSS impacts such as session hijacking, defacement, or other client-side attacks against users viewing the attacker's videos. The vulnerability requires user interaction (viewing the malicious video) and low attack complexity with no privileges required.

Upgrade PeerTube to version 8.2.2 or later, where this vulnerability has been fixed by properly escaping characters in JSON-LD metadata. No other mitigations are specified. Patch status is confirmed by the vendor stating the issue is fixed in 8.2.2.