# PeerTube v8.1.8

- Product: PeerTube (https://whatsnew.fyi/product/peertube)
- Vendor: Framasoft
- Date: 2026-05-23
- Version: v8.1.8
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.1.8

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Automatically remove peertube-plugin-google-analytics-js plugin that was installed via SQL injection exploitation
- **security** — Invalidate all OAuth tokens so all users must log in again
- **added** — Add a new user.disable_root_auth config key to disable root token usage
- **removed** — Remove peertube-plugin-google-analytics-js from the plugin registry

###### IMPORTANT NOTES

:warning:  Follow [v8.1.0 IMPORTANT NOTES](https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.0) if you upgrade from PeerTube <= v8.0.2 :warning: 

We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.
According to our investigation, the attacker exploited this SQL injection to generate a token for the `root` user and install the `peertube-plugin-google-analytics-js` plugin. This plugin imports a client script from `hxxps://www.googie-anaiytics.com/jquery.ui.js` that currently only logs a line in the web browser.

Actions taken by this release:
 * Automatically remove `peertube-plugin-google-analytics-js` in v8.1.8
 * Invalidate OAuth tokens in v8.1.8 (all users must log in again)
 * Add a new `user.disable_root_auth` config key to disable `root` token usage
 * Remove the plugin from the plugin registry

Actions taken by Framasoft:
 * Report `googie-anaiytics.com` to the registrar
 * Send a contact-form message to public PeerTube instances
 * Release additional versions if we observe other attack vectors
 * A CVE is being requested for the SQL injection

Actions admins must take:
 * Upgrade to v8.1.8 **as soon as possible**
 * Review newly created users and videos
 * Review your instance configuration, especially *Configuration* -> *Customization* -> *JavaScript*/*CSS*
 * Review installed plugins
 * Generate new tokens for your runners

If you cannot upgrade to v8.1.8:
 1. Remove actor follows that contain the `20.240.202.159` URL:
   * Find them: `SELECT * FROM "actorFollow" WHERE "url" LIKE '%20.240.202.159%'`
   * Delete them: `DELETE FROM "actorFollow" WHERE "id" = ...`
 2. Remove actors that contain a `'` character in `inboxUrl`:
   * Find them: `SELECT * FROM "actor" WHERE "inboxUrl" LIKE '%''%'`
   * Delete them: `DELETE FROM "actor" WHERE "id" = ...`
 3. Invalidate OAuth tokens: `UPDATE "oAuthToken" SET "accessTokenExpiresAt" = NOW(), "refreshTokenExpiresAt" = NOW() WHERE "accessTokenExpiresAt" > NOW() OR "refreshTokenExpiresAt" > NOW()`
 4. Remove `peertube-plugin-google-analytics-js` from instance plugins
 5. Disable federation in `production.yaml` by setting `federation.enabled` to `false`
 6. Restart PeerTube