Description
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | 26.0 – ≤ 29.3.0 | — |
References
- GitHub Security Advisory (GHSA-cx46-26xc-2w7f) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering third-party-advisory