Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. Version 21.0 contains a fix. As a workaround, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27568 WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. M… https://www.cve.org/CVERecord?id=CVE-2026-27568
Post summary
CVE-2026-27568 exposes WWBN AVideo to unsanitized Markdown processing via Parsedown v1.7.4, potentially enabling XSS or code injection in video comments.
CVE-2026-27568: Comments That Kill: Inside the AVideo Stored XSS (CVE-2026-27568) In the world of web security, few things are as timeless as Cross-Site Scripting (XSS). It’s the cockroach of vulnerabilities—it survives nuclear wars and framework rewr... https://cvereports.com/reports/CVE-2026-27568
Post summary
The post announces a stored XSS vulnerability (CVE-2026-27568) in AVideo, linking to a detailed report but providing no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |