Jitsi vulnerabilities
We track 5 vulnerabilities in Jitsi products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Jitsi vulnerabilities
- 7.4 High severity
@jitsi/electron-sdk: Missing Authorization
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sour
- 9.8 Critical severity
meet: Improper Neutralization of Input During Web Page Generation
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.
- 7.5 High severity
meet: Improper Neutralization of Input During Web Page Generation
In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format.
- 7.5 High severity
meet: Weak Password Recovery Mechanism for Forgotten Password
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
- 9.8 Critical severity
https://github.com/jitsi: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.