Jellystat SQLi to RCE Critical Vulnerability (CVE-2026-41167)

The National Vulnerability Database has detailed CVE-2026-41167, a critical SQL injection vulnerability in Jellystat, a free and open-source statistics application for Jellyfin. Prior to version 1.1.10, multiple API endpoints, specifically POST /api/getUserDetails and POST /api/getLibrary, construct SQL queries by directly interpolating unsanitized request-body fields.

This flaw allows an authenticated attacker to inject arbitrary SQL, leading to full data disclosure from any database table. Crucially, this includes app_config, which stores sensitive data like Jellystat admin credentials, Jellyfin API keys, and the Jellyfin host URL. The node-postgres simple query protocol, used by the vulnerable call site, permits stacked queries, escalating the injection from data disclosure to arbitrary command execution on the PostgreSQL host via COPY ... TO PROGRAM.

Given the PostgreSQL superuser role assigned by the project’s docker-compose.yml, no additional privileges are needed to achieve this RCE. The CVSS score of 9.1 (CRITICAL) underscores the severity. Defenders using Jellystat must prioritize patching to version 1.1.10 immediately to mitigate this high-impact vulnerability.