WWBN AVideo CVE-2026-41063

The attacker must hold a low-privilege authenticated account on the target AVideo instance with permission to post comments - unauthenticated exploitation is not possible (CVSS PR:L). The commenting feature must be enabled, which is the default configuration; no non-default server-side setting is required to be vulnerable. Victim interaction is mandatory: the targeted user must load a page containing the malicious comment and actively click the crafted link (CVSS UI:R). Exploitation is bounded to AVideo instances running version 29.0 or below. The setSafeMode(false) call is hardcoded in markDownToHTML(), so no special deployment mode or optional feature flag is needed - the bypass is present in all default AVideo setups within the affected version range. SSVC's non-automatable designation confirms that mass exploitation is not feasible; each successful XSS delivery requires an individual victim click.

The CVSS 3.1 score of 5.4 Medium with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately reflects real-world constraints: the attacker must hold a low-privilege account (PR:L) to submit comments, and a victim must actively click the crafted link (UI:R). The Scope change (S:C) captures that injected JavaScript executes in the victim's browser context rather than solely affecting the attacker's session. EPSS at 0.03% (9th percentile) and absence from CISA KEV are consistent with SSVC's assessment of non-automatable exploitation with partial technical impact - this vulnerability requires manual social engineering to deliver payload to each victim and has not been operationalized at scale. Despite the moderate CVSS score, the stored (persistent) nature of the XSS meaningfully elevates practical risk over a reflected variant: a single malicious comment persists and targets all future viewers without further attacker involvement. For AVideo deployments that permit untrusted or public user registration with comment privileges, this represents a genuine session-hijacking and credential-theft risk that warrants prompt patching despite low EPSS.

An authenticated AVideo user with comment privileges posts a comment on a public video page containing the markdown payload [Click here](javascript:alert(document.cookie)). Because inlineLink() is not overridden by the sanitizer and safeMode is disabled, Parsedown renders this as a live anchor tag with a javascript: href. Any subsequent visitor who loads the comment section and clicks the link executes the attacker's JavaScript in their authenticated browser session, enabling cookie exfiltration or session hijacking. A proof-of-concept for this technique exists per SSVC designation.