Unauthenticated Reflected XSS via innerHTML in AVideo
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33035
CWE: CWE-79

## Summary AVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's `json_encode()` into a JavaScript function that renders it via `innerHTML`, bypassing encoding and achieving full script execution. ## Root Cause The vulnerability is caused by two issues working together: ### 1. Source: Unescaped user input passed to JavaScript (videoNotFound.php) **File:** `view/videoNotFound.php` line 49 ```php if (!empty($_REQUEST['404ErrorMsg'])) { echo 'avideoAlertInfo(' . json_encode($_REQUEST['404ErrorMsg']) . ');'; } ``` PHP's `json_encode()` with default flags only escapes quotes (`"` → `\"`) and backslashes. It does **NOT** escape HTML special characters (`<`, `>`, `/`). The resulting string contains raw HTML tags that are passed directly to JavaScript. ### 2. Sink: innerHTML renders HTML tags as executable DOM (script.js) **File:** `view/js/script.js` ```javascript function avideoAlertInfo(msg) { // line ~1891 avideoAlert("", msg, 'info'); // calls ↓ } function avideoAlert(title, msg, type) { // line ~1270 avideoAlertHTMLText(title, msg, type); // calls ↓ } function avideoAlertHTMLText(title, msg, type) { // line ~1451 var span = document.createElement("span"); span.innerHTML = msg; // line 1464 — XSS SINK swal({ content: span }); } ``` `innerHTML` parses the string as HT


Mitigations:

Architectural layers (MAESTRO):