CVE-2026-41063: WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)
WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's ParsedownSafeWithLinks class overrides inlineMarkup for raw HTML but does not override inlineLink() or inlineUrlTag(), allowing javascript: URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41063?
CVE-2026-41063 is classified as a medium severity vulnerability due to its potential to allow Cross-Site Scripting (XSS) attacks.
What versions of AVideo are affected by CVE-2026-41063?
AVideo versions 29.0 and below are affected by CVE-2026-41063.
How do I fix CVE-2026-41063?
To fix CVE-2026-41063, update your AVideo installation to a version above 29.0 that includes the complete fix for the XSS vulnerability.
What is the nature of the vulnerability in CVE-2026-41063?
CVE-2026-41063 is an incomplete fix for a previously identified XSS vulnerability that allows bypassing protections in the ParsedownSafeWithLinks class.
Can CVE-2026-41063 lead to data exposure?
Yes, if exploited, CVE-2026-41063 could allow attackers to execute malicious scripts, potentially leading to user data exposure.