CVE-2026-116139 in AVideo
Summary
by MITRE • 10/25/2026
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in WWBN AVideo versions 26.0 through 29.3.0 represents a significant security flaw within the platform's content rendering engine, specifically affecting how user-generated comments are processed and displayed to other users. This issue is classified as a stored cross-site scripting (XSS) attack, which differs from reflected XSS in that the malicious script payload is permanently stored on the target server, typically within a database or comment field, and executed whenever a victim views the affected content. In this specific instance, the flaw resides in the markDownToHTML function, which serves as the bridge between user input formatted with Markdown syntax and the final HTML output rendered by web browsers. The core technical failure is that this conversion process preserves event-handler attributes within leading HTML blocks rather than stripping them out or encoding them to neutralize their executable nature.
From a technical perspective, the vulnerability exploits the permissive handling of raw HTML tags during the markdown parsing phase. An authenticated user with commenting privileges can craft a malicious comment by initiating it with an img tag that includes an onerror event handler attribute containing arbitrary JavaScript code. Because the sanitizer logic fails to adequately validate or escape these attributes when they appear at the start of the content block, the browser interprets them as valid executable instructions rather than static text data. This bypasses standard inline sanitization mechanisms designed to prevent script injection, allowing the attacker's payload to persist in the system and trigger automatically for any other user who loads the page containing the compromised comment.
The operational impact of this vulnerability is severe due to its stored nature and broad execution scope. Once a malicious comment is posted, it becomes part of the persistent data store associated with that video or content item. Consequently, every subsequent visitor to that specific URL will have their browser execute the injected JavaScript under the application's origin context. This allows attackers to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized actions on behalf of victims, defacing the website interface, or redirecting users to malicious external sites. Since the attack is triggered simply by viewing the page, it does not require social engineering tactics like phishing links, making it highly effective against unsuspecting audiences and potentially leading to widespread compromise if left unpatched.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism of preserving event handlers in HTML blocks also relates to CWE-830, where inclusion of a web resource via an incorrect method leads to security vulnerabilities. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Client-side Injection and potentially Account Manipulation if used for session hijacking. The attack vector is categorized under T1189 Drive-by Compromise or T1053 Scheduled Task/Job depending on further exploitation steps, but primarily falls under web application attacks leveraging stored payloads.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Administrators should immediately upgrade WWBN AVideo to a version newer than 29.3.0 where this sanitization logic has been corrected. For environments where upgrading is not immediately feasible, implementing a Web Application Firewall (WAF) with rules specifically targeting event handler attributes in comment fields can provide temporary protection by blocking requests containing patterns like onerror= or similar JavaScript events within user inputs. Furthermore, developers should enforce strict output encoding and context-aware escaping when rendering markdown content to HTML, ensuring that all special characters are converted to their corresponding HTML entities before being sent to the browser. Adopting a Content Security Policy (CSP) with restrictive script-src directives can also mitigate the impact by preventing the execution of unauthorized scripts even if they manage to be injected into the DOM.