CVE-2026-88868: AVideo LiveLinks Stored XSS via title and description fields
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators, within the site origin.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the malicious script?
An attacker needs an AVideo account with canStream permission to submit a crafted LiveLinks title or description. Any visitor who views the affected live-link page can execute the stored script in the AVideo site origin, including administrators.
Does exploitation require interaction from a victim?
Yes. The attacker must have canStream permission, and a victim must visit a live-link page containing the malicious title or description. No additional victim action is described beyond viewing that page.
How can I determine whether my deployment is affected?
Deployments are affected if they use the LiveLinks plugin in AVideo at or before commit c3edcc274c389816d434acadac07ee78eaf330c1 and allow users with canStream permission to create LiveLinks content. Review existing LiveLinks titles and descriptions for injected script content, especially content created by non-administrative streaming users.