Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.

INFO

Published Date :

2026-04-21T22:59:52.770Z

Last Modified :

2026-04-22T18:35:53.306Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-41063 vulnerability.

Vendors Products
Wwbn
  • Avideo
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41063.

URL Resource
https://github.com/WWBN/AVideo/commit/3ae02fa240939dbefc5949d64f05790fd25d728d cve-icon cve-icon
https://github.com/WWBN/AVideo/commit/cae8f0dadbdd962c89b91d0095c76edb8aadcacf cve-icon cve-icon
https://github.com/WWBN/AVideo/security/advisories/GHSA-72h5-39r7-r26j cve-icon cve-icon
https://github.com/WWBN/AVideo/security/advisories/GHSA-m7r8-6q9j-m2hc cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact