WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33500
CVE-2026-41063
CWE: CWE-79
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

### Summary The incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization. ### Affected Package - **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** < commit 3ae02fa24093 - **Patched versions:** >= commit 3ae02fa24093 ### Details In `objects/functionsSecurity.php`, the `ParsedownSafeWithLinks` class: - Overrides `blockMarkup()` -- blocks non-`<a>`/`<img>` HTML tags - Overrides `inlineMarkup()` -- sanitizes `<a href=...>` and `<img src=...>` in raw HTML, including an href whitelist But the base `Parsedown.php` class has two additional methods that generate `<a>` tags: - `inlineLink()` (line ~1388) -- processes `[text](url)` markdown syntax, sets `href` = URL directly - `inlineUrlTag()` (line ~1558) -- processes `<URL>` auto-link syntax, sets `href` = URL directly Neither is overridden by `ParsedownSafeWithLinks`, so `[Click me](javascript:alert(document.cookie))` produces `<a href="javascript:alert(document.cookie)">Click me</a>` without any sanitization. The fix sanitizes raw HTML `<a>` tags via `inlineMarkup` but misses the markdown-native link syntax (`[text](url)`) and auto-link syntax (`<url>`) which produce `<a>` tags through different code paths in the base Parsedown class. ### PoC ```python """ CVE-2026-33500 - Incomplete XSS fix in AVideo ParsedownSafeWithLinks Tests R


Mitigations:

Architectural layers (MAESTRO):