Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M
CVE-2026-27568AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
Medium 5.1
In plain English
A medium-severity cross-site scripting in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. Version 21.0 contains a fix. As a workaround, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | wwbn/avideo | 21.0 | GHSA-rcqw-6466-3mv7 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-rcqw-6466-3mv7 x_refsource_CONFIRM
- https://github.com/WWBN/AVideo/commit/ade348ed6d28b3797162c3d9e98054fb09ec51d7 x_refsource_MISC
- https://github.com/WWBN/AVideo/releases/tag/21.0 x_refsource_MISC