CVE-2022-25229: Popcorn Time Project Popcorn Time

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Affected products

• Popcorn Time Project Popcorn Time: version 0.4.7 only

Published 2022-05-20. Last modified 2026-06-17.