WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
Date: 2026-06
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-49279
CWE: CWE-79

# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json);


Mitigations:

Architectural layers (MAESTRO):