https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T22:07:52.093515+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-49279 fkie_cve-2026-49279 2026-10-15T22:07:52.108047+00:00

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim's behalf, in the default SQLite WebSocket backend configuration. This issue has a patch that has yet to be officially released, see https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23.

 https://db.gcve.eu/vuln/ghsa-2fhx-q92v-5fhv GHSA-2fhx-q92v-5fhv — WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) 2026-10-15T22:07:52.108133+00:00

Affected: Packagist: wwbn/avideo

# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler

## Summary

AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely.

## Affected Versions

AVideo <= latest

## Vulnerability Details

### Root Cause: Shallow sanitization only covers `$json['msg']`

`plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix:

```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ```

`plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`:

```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ```

Compare with the correctly patched `Message.php` (lines 254-256):

```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ```

And `MessageSQLiteV2.php` (lines 302-303):

```php $json = removeAutoEvalCodeOnHTMLRecursive($json)…