What is the CVSS score of CVE-2026-41063?

CVE-2026-41063 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WWBN AVideo CVE-2026-41063

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 security-advisories@github.com

XSS Avideo

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L because comment submission requires authentication; UI:R because victim must click the link; S:C reflects JavaScript executing in victim's browser cross-context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:24 vuln.today

Analysis Generated

Jul 24, 2026 - 05:24 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete XSS fix in AVideo's ParsedownSafeWithLinks class overrides inlineMarkup for raw HTML but does not override inlineLink() or inlineUrlTag(), allowing javascript: URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.

AnalysisAI

Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using javascript: URI schemes that bypass the platform's custom ParsedownSafeWithLinks sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML <a> tag processing through inlineMarkup() but left Parsedown's inlineLink() and inlineUrlTag() methods unguarded, while simultaneously disabling Parsedown's built-in safeMode filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.

Technical ContextAI

AVideo uses the Parsedown markdown library (composer/wwbn/avideo, CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) to render user-submitted comments as HTML. The ParsedownSafeWithLinks class was introduced as a layered fix for CVE-2026-27568, overriding blockMarkup() and inlineMarkup() to intercept raw HTML <a> tags and whitelist-filter URL schemes via sanitizeATag() (allowing only http(s), mailto, relative paths, and anchors). However, markdown-syntax links of the form [text](url) are parsed by Parsedown's native inlineLink() method at vendor/erusev/parsedown/Parsedown.php:1258, which builds an element array and routes it through element(). Because markDownToHTML() at functionsSecurity.php:445 explicitly calls setSafeMode(false), Parsedown's sanitiseElement() guard - which would invoke filterUnsafeUrlInAttribute() to neutralize javascript: schemes - is never reached. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: a sanitization bypass via an unpatched code path in the same rendering pipeline the fix was meant to secure.

RemediationAI

The upstream fix is available as commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf (https://github.com/WWBN/AVideo/commit/cae8f0dadbdd962c89b91d0095c76edb8aadcacf), which adds an inlineLink() override to ParsedownSafeWithLinks that applies the same scheme whitelist already used by sanitizeATag(), stripping any href that does not begin with http(s), mailto, a forward slash, or a hash. A second related commit is referenced at https://github.com/WWBN/AVideo/commit/3ae02fa240939dbefc5949d64f05790fd25d728d. No tagged release version containing these fixes has been independently confirmed from available data - the fix exists only as commit references; administrators should apply the commits directly and monitor the upstream repository for a formal release. As an immediate compensating control, restricting comment privileges to trusted or verified users eliminates the attack surface without service disruption. Alternatively, changing setSafeMode(false) to setSafeMode(true) in markDownToHTML() at functionsSecurity.php:445 would re-enable Parsedown's built-in javascript: URI filtering, though this may alter rendering behavior for some markdown constructs and should be tested before deployment in production.