Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcqw-6466-3mv7) introduced a custom `ParsedownSafeWithLinks` class that sanitizes raw HTML `<a>` and `<img>` tags in comments, but explicitly disables Parsedown's `safeMode`. This creates a bypass: markdown link syntax `[text](javascript:alert(1))` is processed by Parsedown's `inlineLink()` method, which does not go through the custom `sanitizeATag()` sanitization (that only handles raw HTML tags). With `safeMode` disabled, Parsedown's built-in `javascript:` URI filtering (`sanitiseElement()`/`filterUnsafeUrlInAttribute()`) is also inactive. An attacker can inject stored XSS via comment markdown links. Commit 3ae02fa240939dbefc5949d64f05790fd25d728d contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-23 | 2 | Disclosure2 |
| 2026-04-15 | 1 | Disclosure1 |
🔴 AVideo, XSS Bypass, #CVE-2026-33500 (Critical) https://dailycve.com/avideo-xss-bypass-cve-2026-33500-critical/
Post summary
A new critical XSS bypass vulnerability, CVE-2026-33500, has been disclosed in the AVideo platform.
CVE-2026-33500 Stored XSS Vulnerability in WWBN AVideo via Markdown Link Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33500
Post summary
The entry announces CVE-2026-33500 as a stored XSS flaw in WWBN AVideo that can be triggered through Markdown link injection, with more details available via the supplied link.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33500 - AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization Intel Report: https://ift.tt/EczPOnY
Post summary
The alert announces CVE-2026-33500 as a stored XSS vulnerability in AVideo caused by markdown `javascript:` URIs bypassing ParsedownSafeWithLinks sanitization.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |