CVE-2023-2191 is a low-severity (CVSS 3.5) Cross-site Scripting (XSS) vulnerability in azuracast/azuracast. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for azuracast/azuracast — see the affected versions and patch details below.
Cross-site Scripting (XSS) - Stored in azuracast/azuracast
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-2191.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
azuracast/azuracastReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is only visible to the current logged-in user (pages like the Administer Users page are unaffected by this vulnerability), but if a higher-privileged administrator uses the Log In As feature to masquerade as a user, then the JavaScript injection could exfiltrate certain data. Anonymous members of the public cannot exploit this vulnerability in an AzuraCast installation, so it is primarily of concern for multi-tenant installations (i.e. resellers).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | azuracast/azuracast | all versions | 0.18.0composer require azuracast/azuracast:^0.18.0 |
Affected Products
azuracastazuracastResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for azuracast/azuracast, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update azuracast/azuracast to 0.18.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-2191 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2023-2191 in your dependencies?
Find it across Packagist, including transitive dependencies.