CVE-2022-25229

5.4 mediumEPSS 0.6%

Medium (5.4) in popcorn time project popcorn time. EPSS 0.6% chance of exploitation in the next 30 days.

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-05-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

popcorn_time_project:popcorn_time

References

https://fluidattacks.com/advisories/bowie/
https://github.com/popcorn-official/popcorn-desktop/issues/2491
https://fluidattacks.com/advisories/bowie/
https://github.com/popcorn-official/popcorn-desktop/issues/2491

Check your stack JSON