There have been exploits: https://github.com/jellyfin/jellyfin/security
The project is a fork of another project (Emby) and there has always been potential for user-supplied data ending up in command-line arguments, or exploitation of the (admin) user getting to upload various files. Nonetheless, all reported security bugs have been fixed promptly, and they're proactively sweeping through the full set of APIs they inherited, looking for possible exploit paths.
Most exploits required an authenticated user.
If you're concerned about this, you should run Jellyfin's docker image, with read-only mounts of your media library, and only give accounts to people you trust, which is how you should treat your personal media library anyway.
A lot of Jellyfin's API doesn't require any authentication at all, as an example.
> Is this a massive red-flag security risk that actively exposes your data to the Internet? No.
>
> At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above..