CVE-2018-8831
Medium · 6.1CVSS
6.1
EPSS
52.0%
Published
Apr 18, 2018
CISA due date
—
The record
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Ubuntu:16.04:LTS | kodi | 0 | No fix |
| Ubuntu:18.04:LTS | kodi | 0 | No fix |
| Ubuntu:20.04:LTS | kodi | 0 | No fix |
| Ubuntu:22.04:LTS | kodi | 0 | No fix |
| Ubuntu:24.04:LTS | kodi | 0 | No fix |
| Ubuntu:24.10 | kodi | 0 | No fix |
| Ubuntu:25.04 | kodi | 0 | No fix |
| Ubuntu:25.10 | kodi | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | kodi | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | kodi | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | kodi | 0 | No fix |
Related vulnerabilities
- CVE-2017-5982 Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote… Also affects kodi
- CVE-2015-3885 Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote… Also affects kodi
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79