| Package | Affected versions | Patched versions |
|---|---|---|
| wwbn/avideo | < 21.0 | 21.0 |
| avideo | < 21.0 | 21.0 |
Stored Cross-Site Scripting (XSS) — CWE-79.
AVideo 18.0.
AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing javascript: URIs to be rendered as clickable links.
An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration.
The issue was confirmed and fixed in the master branch. An official release will be published soon.
Until the release is available, validate and block unsafe URI schemes (e.g., javascript:) before rendering Markdown, and enable Parsedown Safe Mode.
Reported by Arkadiusz Marta (https://github.com/arkmarta/).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free