AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 11, 2026 CVE-2026-89256

AVideo lets a video's owner plant hidden code in a bookmark or chapter name. Anyone who watches that video then runs the code in their browser, inside the AVideo site itself.

Severity
HighCVSS 3.1 · 8.7 · vulncheck.com
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Affects
AVideo
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-76068ENISA vulnerability database

How it works

  • A user who can edit or upload a video can save a bookmark through the Bookmark plugin's save feature, supplying a chapter name.
  • AVideo stores that name exactly as typed, with no cleanup to strip out code.
  • When the video's public watch page builds its chapter list, it drops the stored name straight into the page instead of showing it as plain text.
  • A browser loading that page then treats the hidden code as something to run, not as a name to display.
  • Every visitor who opens that watch page, including a site administrator, ends up running the planted code under the AVideo site's own identity.

What to do

Check whether your AVideo deployment is built from commit c3edcc274c389816d434acadac07ee78eaf330c1 or an earlier commit, since no later fix exists yet. Check whether the Bookmark plugin is enabled on your site, since the flaw only triggers when that plugin is active. Look at chapter or bookmark names shown under a video's Chapters list for unexpected HTML or script-like text, which can indicate someone already planted a payload.

Watch the GitHub security advisory GHSA-jggq-mm5m-r5wv for a patched commit, since AVideo has not shipped a fix as of this report. Restrict who can edit or upload videos on your AVideo site to trusted accounts in the meantime, since only a user with edit rights on a video can save a malicious bookmark name. Disable the Bookmark plugin if you cannot vet who has upload or edit access, since that removes the vulnerable feature entirely until a fix ships.

Technical details

The Bookmark plugin's bookmarkSave.json.php endpoint passes the submitted name straight to BookmarkTable::setName, which stores it with no encoding. Bookmark::generateChaptersHTML then concatenates that raw value into the HTML for the public watch page, and view/modeYoutubeBottom.php echoes it unescaped. AVideo's own playlist code calls xss_esc before rendering names, but the Bookmark plugin's equivalent path does not, making this a stored XSS reachable by anyone with edit or upload rights on a video (Video::canEdit). No patched commit exists yet per the GitHub advisory.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source