CVE-2026-45381 — Tautulli: Reflected XSS in `/search` endpoint
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScrip…
Published: 2026-09-21 · CVSS: 5.1 · CVSS 4.0
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7