mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[Bug]: Vulnerabilities in Audiobookshelf #3296
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#3296
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cautionespn on GitHub (Apr 13, 2026).
What happened?
Critical CVEs in latest image requiring urgent rebuild
Affected image:
ghcr.io/advplyr/audiobookshelf:latestScanned with: Trivy 0.69.3
Date: April 13, 2026
Summary
A Trivy vulnerability scan of the latest Audiobookshelf Docker image reveals 4 CRITICAL severity CVEs in bundled dependencies. All have fixes available upstream but the image has not been rebuilt to include them.
This is particularly urgent as Audiobookshelf is commonly deployed as an internet-facing service.
Critical Vulnerabilities
Request
Please rebuild and push a new image with updated dependencies to resolve these CVEs. Given that Audiobookshelf is frequently exposed to the internet, patching axios in particular is a priority.
Thank you for maintaining this project.
What did you expect to happen?
Trivy should show no Critical vulnerabilities
Steps to reproduce the issue
Audiobookshelf version
2.33.1
How are you running audiobookshelf?
Docker
What OS is your Audiobookshelf server hosted from?
Linux
If the issue is being seen in the UI, what browsers are you seeing the problem on?
None
Logs
Additional Notes
No response
@nichwall commented on GitHub (Apr 13, 2026):
Vulnarabilites should be reported directly using the security tab, not as a public issue.
Additionally, have you also looked at what the vulnarabilites actually are or just seeing there are vulnerabilities and whether they affect how things are being used or if the specific vulnerable dependency is as a dependency for another library (meaning upgrading is not trivial).
With additional NPM package hijacking going on, this immediately raises red flags for me (I am not meaning to imply that you are attempting this, just to provide more context why private initial reporting can help to make sure there is a chance to fix things before broadcasting to everyone with no fix in place).
@cautionespn commented on GitHub (Apr 15, 2026):
In the future I will use the security tab for things like this.
I understand the concern of the NPM package hijacking, in fact this is the reason I decided to do a series of security audits on my systems and containers. Axios is in fact one of the more prominent nom packages that was compromised. I included links to the exact vulnerabilities that exist in the report above. The 2 Axios vulnerabilities and the form-data vulnerability are critical and should be addressed ASAP.
@advplyr commented on GitHub (Apr 17, 2026):
The Axios issue that got everyone's attention had to do with a version of Axios that we're not using. We're more likely to be affected by these vulnerabilities if we update the package on every patch.
I look through these CVE's and I don't believe they impact audiobookshelf.
CVE-2025-62718is the only one I can see being exploitable in a very very rare case. You would have to be manually setting theHTTPS_PROXYandNO_PROXYenv's, and disabling SSRF filters via env variable, AND a user has update access to set one of those malformed URLs as a podcast feed or something. You're already disabling a security feature at that point which opens up other attack vectors that if you were handling would also handle this one.We're going to completely replace Axios with the native fetch API. If you can provide info on how those other CVE's impact the project then we'll fast track that. Please open as a security advisory if you have more info