CVE-2026-88868 in AVideo
Summary
by MITRE • 09/10/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators, within the site origin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The identified security flaw resides within the LiveLinks plugin for AVideo, specifically affecting versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. This vulnerability is classified as a stored cross-site scripting issue, which represents a severe category of web application security risk where malicious scripts are permanently stored on the target server and subsequently served to users without proper validation or sanitization. The root cause lies in the insufficient input handling mechanisms for the title and description fields within the LiveLinks functionality. When these fields are processed by the backend system, they fail to undergo adequate encoding or escaping procedures before being rendered in HTML contexts. This lack of sanitization allows an attacker to inject executable JavaScript code directly into the database records associated with live links.
The operational impact of this vulnerability is significant due to its persistent nature and broad reach. An authenticated user possessing the canStream permission, which is a relatively common privilege for content creators or streamers on such platforms, can exploit this flaw by crafting malicious payloads within the title or description fields during the creation or modification of a live link. Once these entries are saved, they become part of the persistent data store. Consequently, every user who visits the page displaying the affected live-link will have their browser execute the injected script automatically. This execution occurs within the context of the site's origin, meaning the malicious code inherits all cookies, session tokens, and privileges associated with that domain.
This scenario enables a wide range of potential attacks beyond simple defacement or alert boxes. An attacker could steal administrative credentials by exfiltrating session cookies to an external server, thereby gaining full control over the AVideo instance. Alternatively, the vulnerability can be leveraged for keylogging, phishing via fake login forms injected into the page, or redirecting users to malicious sites designed to distribute malware. The inclusion of administrators in the victim pool is particularly dangerous because it allows a lower-privileged user to escalate their influence by compromising high-level accounts, potentially leading to complete system takeover and further exploitation of backend infrastructure.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). Specifically, it falls under the stored variant where the payload is saved on the server rather than being reflected in an immediate request. In terms of offensive security frameworks, this attack vector corresponds to ATT&CK technique T1059: Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. It also relates to T1204: User Execution if social engineering is used to trick users into clicking specific links, though the persistence mechanism makes it more akin to initial access via compromised accounts or privilege escalation through session hijacking.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves implementing strict output encoding for all user-supplied data rendered in HTML contexts, particularly within the LiveLinks plugin's template files that display title and description fields. Developers should utilize context-aware escaping libraries to ensure special characters are converted into their safe entity equivalents before rendering. Additionally, input validation should be enforced at both the client and server sides to reject or sanitize potentially dangerous script tags and event handlers. Implementing a Content Security Policy (CSP) header can also serve as an effective defense-in-depth measure by restricting the sources from which scripts can be loaded and executed, thereby neutralizing many XSS payloads even if they are successfully injected into the DOM. Regular security audits and code reviews focusing on input handling in dynamic web applications are essential to prevent similar vulnerabilities in future releases.