{"schema":"threatline.record/2","record":{"id":"GHSA-cx46-26xc-2w7f","aliases":["GHSA-cx46-26xc-2w7f"],"summary":"Stored XSS in AVideo comment Markdown block HTML rendering","details":"## Summary\r\nAVideo's comment Markdown renderer preserves raw HTML event-handler attributes when an image starts an HTML block. A user authorized to comment on a viewable video can store a malicious comment that executes JavaScript in the AVideo origin when another user views it, subject to deployment CSP restrictions.\r\n\r\n## Root cause and data flow\r\nComment submission in objects/commentAddNew.json.php requires User::canComment() and permission to watch the video. Comment construction and saving HTML-escape the text with xss_esc(). On retrieval, objects/comment.php decodes it using xss_esc_back() and passes it to markDownToHTML(). The comment UI in view/videoComments.php inserts commentHTML using jQuery .html().\r\n\r\nIn objects/functionsSecurity.php, markDownToHTML() disables Parsedown safe mode and markup escaping. ParsedownSafeWithLinks::inlineMarkup() sanitizes inline image/link tags, but blockMarkup() delegates leading `<img>` and `<a>` tags to Parsedown's raw HTML block handler without applying those sanitizers. Escaping at storage therefore does not protect the final HTML rendering boundary.\r\n\r\n## Reproduction and verification\r\nA standalone test using the repository's Parsedown dependency and the current markDownToHTML() implementation produced:\r\n\r\nInput: `<img src=x onerror=alert(1)>`\r\nOutput: `<img src=x onerror=alert(1) class=\"img img-responsive\">`\r\n\r\nBy contrast, `prefix <img src=\"x\" onerror=\"alert(1)\">` removes the event handler through the inline sanitizer. This verifies the renderer bypass; no live deployment or authenticated browser exploitation was tested during this review.\r\n\r\n## Impact and severity\r\nSuccessful exploitation permits JavaScript execution in a victim's browser under the application origin, potentially reading accessible application data or performing actions with the victim's session. The attacker needs comment permission, comments must be available to the victim, and the victim must view the malicious comment. CSP that blocks inline event handlers can mitigate this payload.\r\n\r\nCVSS v3.1: 5.4 (Moderate), CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This assessment reflects low confidentiality and integrity impact, required attacker privileges and victim interaction; account takeover and availability impact have not been demonstrated.\r\n\r\n## Affected versions\r\nPackage: wwbn/avideo (Composer).\r\nThe regression was introduced by commit f13587c59346b4bf0f449273021d29b869594559, which replaced enabled safe mode and markup escaping with the custom parser and disabled both controls. Release tags 26.0, 29.0, v29.1.0, v29.1.1, v29.2.0 and v29.3.0 contain the vulnerable block path. Tag 25.0 uses safe mode and markup escaping and is not affected by this specific regression. The issue remains present at reviewed master commit 69b55e7811ac2a08cc5d7cb9292e3a8f2e643fdd. The original report examined commit 5e1701fc21c5150533e7b0e65e1c493d81dcf66d; that commit is not the current HEAD.\r\n\r\n## Patch status and mitigation\r\nNo verified patch or patched release was identified as of 2026-10-08. Updating to 29.3.0 or the reviewed master commit does not fix this issue. Until a fix is available, disable comment submission/display for untrusted content, or apply a strict HTML allowlist at the final rendering boundary that removes event attributes and unsafe URI schemes. A restrictive CSP can provide defense in depth.\r\n\r\nThe permanent fix must enforce one sanitization policy for block and inline HTML, including continuation lines, images, links and Markdown-generated URLs. Regression tests should cover the leading image payload, inline forms, multiline HTML blocks and unsafe URI schemes before assigning a patched version.\r\n\r\n## References\r\n- https://github.com/WWBN/AVideo/commit/f13587c59346b4bf0f449273021d29b869594559\r\n- https://github.com/WWBN/AVideo/blob/69b55e7811ac2a08cc5d7cb9292e3a8f2e643fdd/objects/functionsSecurity.php\r\n- https://github.com/WWBN/AVideo/blob/69b55e7811ac2a08cc5d7cb9292e3a8f2e643fdd/objects/comment.php\r\n- https://github.com/WWBN/AVideo/blob/69b55e7811ac2a08cc5d7cb9292e3a8f2e643fdd/view/videoComments.php\r\n\r\n## Credit\r\nReported by @hothaot. Researcher credit is independent of CVE assignment.\r\n","categories":["Unclassified"],"product":"wwbn/avideo","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-cx46-26xc-2w7f","source_modified_at":"2026-10-08T12:51:22Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"composer","name":"wwbn/avideo"},"range":">= 26.0, <= 29.3.0"}],"fixed_versions":[],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-08T12:51:22Z","modified_at":"2026-10-08T12:51:22Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-cx46-26xc-2w7f","fetched_at":"2026-10-25T21:40:15.971031Z","source_modified_at":"2026-10-08T12:51:22Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-08T12:51:22Z","content_hash":"34306611d31b066515d0f7d1fe03bc5876e7a33322cc8d51e83c3ae9ae5ebccd"}}