{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json[\u0027msg\u0027], but msgToResourceId() reads from $msg[\u0027json\u0027] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user\u0027s browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim\u0027s behalf, in the default SQLite WebSocket backend configuration. This issue has a patch that has yet to be officially released, see https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23."
    }
  ],
  "id": "CVE-2026-49279",
  "lastModified": "2026-07-15T22:16:52.163",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-15T22:16:52.163",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T18:55:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler\n\n## Summary\n\nAVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json[\u0027msg\u0027]`, but `msgToResourceId()` reads from `$msg[\u0027json\u0027]` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely.\n\n\n## Affected Versions\n\nAVideo \u003c= latest\n\n## Vulnerability Details\n\n### Root Cause: Shallow sanitization only covers `$json[\u0027msg\u0027]`\n\n`plugin/YPTSocket/MessageSQLite.php` lines 268-271 \u2014 the incomplete fix:\n\n```php\nif (empty($msgObj-\u003eisCommandLineInterface) \u0026\u0026 ($msgObj-\u003esentFrom ?? \u0027\u0027) !== \u0027php\u0027) {\n    if (is_array($json[\u0027msg\u0027] ?? null)) {\n        unset($json[\u0027msg\u0027][\u0027autoEvalCodeOnHTML\u0027]);  // Only strips from $json[\u0027msg\u0027]\n    }\n}\n```\n\n`plugin/YPTSocket/MessageSQLite.php` lines 361-367 \u2014 the bypass via `msgToResourceId()`:\n\n```php\nif (!empty($msg[\u0027json\u0027])) {\n    $obj[\u0027msg\u0027] = $msg[\u0027json\u0027];       // $msg[\u0027json\u0027][\u0027autoEvalCodeOnHTML\u0027] is NEVER stripped\n} else if (!empty($msg[\u0027msg\u0027])) {\n    $obj[\u0027msg\u0027] = $msg[\u0027msg\u0027];        // Only this path was sanitized\n} else {\n    $obj[\u0027msg\u0027] = $msg;\n}\n```\n\nCompare with the correctly patched `Message.php` (lines 254-256):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Strips from ALL nested paths\n```\n\nAnd `MessageSQLiteV2.php` (lines 302-303):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Same recursive fix\n```\n\n`MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all.\n\n### Attack Chain\n\n- Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg`\n- The fix at line 268-271 only checks `$json[\u0027msg\u0027]` \u2014 the `json` key is untouched\n- `msgToResourceId()` reads `$msg[\u0027json\u0027]` first (line 361) because `!empty($msg[\u0027json\u0027])` is true\n- The payload is delivered to the victim\u0027s WebSocket client and evaluated via `autoEvalCodeOnHTML`\n\n## Proof of Concept\n\n```javascript\n// Connect to AVideo WebSocket as authenticated user\nconst ws = new WebSocket(\u0027wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN\u0027);\n\nws.onopen = () =\u003e {\n  ws.send(JSON.stringify({\n    msg: \"Hello\",                               // sanitized path \u2014 decoy\n    json: {autoEvalCodeOnHTML: \"alert(\u0027XSS\u0027)\"},  // unsanitized path \u2014 payload\n    to_users_id: VICTIM_USER_ID,\n    resourceId: RESOURCE_ID\n  }));\n};\n// Victim\u0027s client evaluates alert(\u0027XSS\u0027) via autoEvalCodeOnHTML mechanism\n```\n\n## Impact\n\nAn authenticated attacker can:\n\n- Execute arbitrary JavaScript in any connected user\u0027s browser session via the WebSocket messaging system\n- Steal session cookies and authentication tokens\n- Perform account takeover via session hijacking\n- Chain with CSRF to execute admin actions on behalf of the victim\n\nThe vulnerability affects the default SQLite WebSocket backend configuration.\n\n## Suggested Remediation\n\nApply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`:\n\n```php\n// Before (vulnerable \u2014 shallow strip):\nif (is_array($json[\u0027msg\u0027] ?? null)) {\n    unset($json[\u0027msg\u0027][\u0027autoEvalCodeOnHTML\u0027]);\n}\n\n// After (fixed \u2014 recursive strip):\n$json = removeAutoEvalCodeOnHTMLRecursive($json);\n```",
  "id": "GHSA-2fhx-q92v-5fhv",
  "modified": "2026-06-04T18:55:04Z",
  "published": "2026-06-04T18:55:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)"
}