What is the CVSS score of CVE-2026-39367?

CVE-2026-39367 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Avideo CVE-2026-39367

EUVD-2026-19879 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

GHSA-rqp3-gf5h-mrqx

XSS Avideo

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19879

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:22 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

AnalysisAI

Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject malicious JavaScript into EPG (Electronic Program Guide) XML files, which executes in the browsers of unauthenticated visitors to the public EPG page without sanitization. Attackers can exploit this to hijack sessions and takeover accounts of any user viewing the compromised EPG. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

AVideo's EPG feature fetches and parses XML from user-supplied URLs (epg_link parameter) and directly renders programme title elements into HTML without HTML entity encoding or content security policies. The vulnerability stems from improper input validation and output encoding, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is identified by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* across all versions up to and including 26.0. The root cause is the application's failure to escape user-controlled XML content before rendering it in a browser context where it is interpreted as executable JavaScript.

RemediationAI

Apply the upstream fix by updating to a version posterior to the commit e0212add4aad0f1e97758a4b4fdc57df58ce68e8 available at https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8. As an interim mitigation, restrict EPG upload permissions to trusted administrators only and implement Content Security Policy (CSP) headers on pages rendering EPG content to block inline JavaScript execution. Additionally, ensure that the epg_link parameter is validated to only accept URLs from whitelisted domains, and consider disabling the EPG feature entirely if not required. Consult the official GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx for comprehensive patching guidance.