{"id":"CVE-2018-8831","aliases":["ALPINE-CVE-2018-8831","EUVD-2018-20439","GHSA-h8r8-r3f3-wmh3","UBUNTU-CVE-2018-8831"],"status":"published","title":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the...","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.52009,"percentile":0.98962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2018-04-18T17:00:00Z","modified":"2026-11-03T06:31:32Z","exploits":[{"source":"exploitdb","id":"EDB-44487","title":"Kodi 17.6 - Persistent Cross-Site Scripting","type":"webapps","platform":"multiple","date":"2018-04-18","url":"https://www.exploit-db.com/exploits/44487"}],"fixes":[{"ecosystem":"Alpine:v3.11","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"kodi","fixed_in":["18.2-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2-r0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.1+dfsg1-3","15.2+dfsg1-1build1","15.2+dfsg1-3","15.2+dfsg1-3ubuntu1","15.2+dfsg1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.3+dfsg1-3","2:17.3+dfsg1-3build1","2:17.3+dfsg1-5","2:17.3+dfsg1-5build1","2:17.3+dfsg1-5build2","2:17.6+dfsg1-1","2:17.6+dfsg1-1build1","2:17.6+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.6+dfsg1-4ubuntu4","2:17.6+dfsg1-4ubuntu9","2:17.6+dfsg1-4ubuntu10","2:18.5+dfsg1-0ubuntu3","2:18.6+dfsg1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:19.1+dfsg2-2","2:19.3+dfsg1-1","2:19.3+dfsg1-1build2","2:19.3+dfsg1-1build3","2:19.3+dfsg1-1build4","2:19.3+dfsg1-1build5","2:19.4+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:20.2+dfsg-4","2:20.2+dfsg-4build1","2:20.2+dfsg-4build2","2:20.2+dfsg-4ubuntu1","2:20.3+dfsg-1","2:20.4+dfsg-1","2:20.5+dfsg-1build2","2:20.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-1build2","2:21.2+dfsg-4","2:21.2+dfsg-4build1","2:21.2+dfsg-4build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.3+dfsg-1ubuntu1","2:21.3+dfsg-1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-4build2","2:21.2+dfsg-4build3","2:21.2+dfsg-5","2:21.3+dfsg-1","2:21.3+dfsg-1build1","2:21.3+dfsg-1ubuntu1"]}],"products":[{"vendor":"kodi","product":"kodi"}],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Apr/36","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","report"]},{"url":"https://www.exploit-db.com/exploits/44487/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://trac.kodi.tv/ticket/17814","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8831"},{"url":"https://github.com/advisories/GHSA-h8r8-r3f3-wmh3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-8831","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-8831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8831","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-8831","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2018-04-18T17:00:00Z","modified":"2024-08-05T07:02:26.128Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2018-20439","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2018-04-18T17:00:00Z","modified":"2024-08-05T07:02:26Z","updated_at":"2026-11-03T02:40:01.4233Z"}],"ghsa":[{"id":"GHSA-h8r8-r3f3-wmh3","title":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the...","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2022-05-14T03:21:42Z","modified":"2023-02-02T05:07:25Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:30.062581Z"}],"nvd":[{"id":"CVE-2018-8831","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2018-04-18T17:29:00.27Z","modified":"2026-06-17T02:05:28.257Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:25.506659Z"}],"osv":[{"id":"ALPINE-CVE-2018-8831","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2018-04-18T17:29:00.27Z","modified":"2026-11-03T06:31:32.31780187Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"UBUNTU-CVE-2018-8831","description":"A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.","status":"published","published":"2018-04-18T17:29:00Z","modified":"2026-10-17T12:55:28.890559257Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"}]}}