CVE-2025-62613: VDO.Ninja Reflected XSS Vulnerability

CVE-2025-62613 Overview

CVE-2025-62613 is a reflected Cross-Site Scripting (XSS) vulnerability in VDO.Ninja, a WebRTC-based tool that streams remote video feeds into OBS and other studio software. The flaw exists in examples/control.html, where the room URL parameter is written directly into the DOM without sanitization or encoding. Attackers can craft a malicious URL that injects arbitrary JavaScript into a victim's browser session when the link is opened. The vulnerability affects versions 28.0 through 28.3 and is patched in version 28.4. It is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser context by tricking users into clicking a crafted VDO.Ninja control URL, enabling session hijacking, credential theft, or unauthorized WebRTC session manipulation.

Affected Products

VDO.Ninja versions 28.0 through 28.3
Deployments hosting the examples/control.html interface
Self-hosted VDO.Ninja instances prior to version 28.4

Discovery Timeline

2025-10-22 - CVE-2025-62613 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62613

Vulnerability Analysis

The vulnerability resides in the examples/control.html page of VDO.Ninja. The page reads the room query parameter from the URL and concatenates its value directly into an innerHTML assignment on the document body. Because the value flows to a DOM sink without HTML encoding, an attacker-controlled string that contains HTML or script markup executes in the browser.

Exploitation requires only that a victim visit an attacker-crafted URL. The injected script runs under the origin of the VDO.Ninja host, giving it access to page cookies, local storage, and any active WebRTC signaling context. In multi-tenant or self-hosted deployments, this can lead to session compromise or manipulation of live streaming sessions.

Root Cause

The root cause is unsafe DOM manipulation. The pre-patch code path assigns the room parameter to document.getElementById("body").innerHTML after concatenating it into a URL string. No validation or output encoding is applied, allowing markup such as <img src=x onerror=...> to be parsed and executed.

Attack Vector

An attacker crafts a URL such as https://vdo.ninja/examples/control.html?room=<payload> and delivers it via phishing, chat, or embedded links. When the victim opens the link, the payload is reflected into the DOM and executed. No authentication is required and user interaction is limited to visiting the URL.

text

// Pre-patch (vulnerable): raw roomID concatenated into innerHTML
if (urlParams.has("room")){
    roomID = urlParams.get("room");
} else {
    roomID = generateStreamID();
    updateURL("room="+roomID);
}

var url = document.URL.substr(0,document.URL.lastIndexOf('/'));

navigator.clipboard.writeText(url+"/mixer?room="+roomID);

// Vulnerable sink: unencoded roomID written to innerHTML
document.getElementById("body").innerHTML += url+"/mixer?room="+roomID;

// Post-patch (fixed): value encoded with encodeURIComponent before use
var mixerURL = url + "/mixer?room=" + encodeURIComponent(roomID);
var bodyElement = document.getElementById("body");

Source: GitHub Commit 83c0ac7

Detection Methods for CVE-2025-62613

Indicators of Compromise

Web server access logs containing requests to examples/control.html with room parameter values that include <, >, ", script, onerror, or URL-encoded equivalents such as %3Cscript%3E.
Referrer entries from external domains directing users to control.html with unusually long or obfuscated room values.
Browser console errors or Content Security Policy violation reports originating from the control.html page.

Detection Strategies

Inspect HTTP query strings for the room parameter on paths matching examples/control.html and flag values containing HTML metacharacters or JavaScript keywords.
Deploy Content Security Policy (CSP) reporting to capture inline script execution attempts on VDO.Ninja pages.
Correlate phishing or link-delivery telemetry with subsequent visits to VDO.Ninja hosts to identify potential exploitation attempts.

Monitoring Recommendations

Alert on web application firewall (WAF) rules matching reflected XSS signatures against /examples/control.html request paths.
Monitor endpoint browser telemetry for unexpected script execution or credential access originating from VDO.Ninja origins.
Track outbound connections from user browsers to unknown domains immediately after visits to VDO.Ninja control.html.

How to Mitigate CVE-2025-62613

Immediate Actions Required

Upgrade all VDO.Ninja deployments to version 28.4 or later, which contains the official fix.
Audit hosted instances for use of the examples/control.html page and restrict access if the control interface is not required.
Notify users of self-hosted instances and rotate any credentials that may have been exposed through prior sessions.

Patch Information

The vulnerability is patched in VDO.Ninja version 28.4. The fix applies encodeURIComponent() to the roomID value before it is inserted into URLs and DOM content, preventing HTML and script injection. See the GitHub Release v28.4, the security advisory GHSA-mp9c-cpch-x73c, and the remediation commit.

Workarounds

Block or remove the examples/control.html file from production deployments if patching cannot occur immediately.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted sources on VDO.Ninja pages.
Configure a WAF rule to reject requests to control.html where the room parameter contains HTML metacharacters or script tokens.

bash

# Example NGINX rule: block requests to control.html with suspicious room parameter values
location = /examples/control.html {
    if ($arg_room ~* "(<|>|script|onerror|onload|javascript:|%3C|%3E)") {
        return 403;
    }
    # Enforce a restrictive Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}