CVE-2022-25229

Name of the Vulnerable Software and Affected Versions Popcorn Time version 0.4.7

Description The issue is related to a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on, allowing the webpage to use NodeJs features. An attacker can leverage this to run OS commands.

Recommendations For Popcorn Time version 0.4.7, consider disabling the 'nodeIntegration' configuration as a temporary workaround to minimize the risk of exploitation. Restrict access to the 'Movies API Server(s)' field in the settings page until a patch is available. Avoid using the 'settings' page with the 'nodeIntegration' configuration enabled until the issue is resolved.