Vulnerability Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.
Related Weaknesses (CWE)
References
- https://github.com/Tautulli/Tautulli/commit/3bee54087370fc275b13565a9e58235341bb
- https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
- https://github.com/Tautulli/Tautulli/security/advisories/GHSA-mjvc-6cc2-6ffr
- https://github.com/Tautulli/Tautulli/security/advisories/GHSA-mjvc-6cc2-6ffr
FAQ
What is CVE-2026-45381?
CVE-2026-45381 is a documented vulnerability. Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interf...
How severe is CVE-2026-45381?
CVSS scoring is not yet available for CVE-2026-45381. Check NVD for updates.
Is there a patch for CVE-2026-45381?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.