CVE-2026-33500: Wwbn Avideo Stored XSS Vulnerability

CVE-2026-33500 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in WWBN AVideo, an open source video platform. In versions up to and including 26.0, an incomplete security fix for a prior vulnerability (CVE-2026-27568) introduced a custom ParsedownSafeWithLinks class that sanitizes raw HTML <a> and <img> tags in comments but explicitly disables Parsedown's safeMode. This creates a bypass where markdown link syntax containing javascript: URIs is processed without proper sanitization, allowing attackers to inject malicious scripts through comment markdown links.

Critical Impact

Attackers can inject stored XSS payloads via comment markdown links, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

Affected Products

• WWBN AVideo versions up to and including 26.0

Discovery Timeline

• 2026-03-23 - CVE-2026-33500 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33500

Vulnerability Analysis

This vulnerability stems from an incomplete security remediation effort. The custom ParsedownSafeWithLinks class was introduced to address a previous XSS vulnerability (CVE-2026-27568) by sanitizing raw HTML <a> and <img> tags within user comments. However, the implementation explicitly disables Parsedown's safeMode, which inadvertently creates a bypass vector.

When markdown link syntax such as [text](javascript:alert(1)) is submitted, it is processed by Parsedown's inlineLink() method. This method does not route the input through the custom sanitizeATag() function, as that sanitization logic only handles raw HTML tags. Furthermore, with safeMode disabled, Parsedown's built-in javascript: URI filtering mechanisms (sanitiseElement() and filterUnsafeUrlInAttribute()) remain inactive, allowing the malicious payload to be stored and subsequently executed when the comment is rendered.

Root Cause

The root cause is the improper disabling of Parsedown's safeMode combined with incomplete sanitization coverage. The custom sanitization class only processes raw HTML anchor and image tags, leaving markdown-formatted links unprotected. This architectural oversight means that while direct HTML injection is blocked, the equivalent functionality via markdown syntax remains exploitable.

Attack Vector

This is a network-based attack requiring low privileges (authenticated user) and user interaction (victim must view the malicious comment). An attacker with the ability to post comments can craft a malicious markdown link containing a javascript: URI. When another user views the comment, the malicious script executes in their browser context with the scope change affecting other users, enabling potential data exfiltration and session compromise.

The attack leverages the markdown parsing flow where [text](javascript:payload) bypasses HTML sanitization because it's processed as markdown rather than raw HTML. The vulnerability allows stored XSS, making it particularly dangerous as the malicious payload persists and affects all users who view the compromised content.

Detection Methods for CVE-2026-33500

Indicators of Compromise

• Presence of javascript: protocol within markdown link syntax in comment fields
• Comments containing patterns like [text](javascript: or [text](data:text/html;
• Unexpected script execution events originating from comment sections
• Browser console errors indicating blocked script execution from sanitization bypasses

Detection Strategies

• Implement content security policy (CSP) monitoring to detect inline script execution attempts
• Review web application logs for comment submissions containing suspicious markdown patterns
• Deploy web application firewall (WAF) rules to flag javascript: and data: URIs in markdown link syntax
• Monitor for unusual client-side behavior such as unexpected cookie access or DOM manipulation

Monitoring Recommendations

• Enable detailed logging of comment content at submission time for forensic analysis
• Configure browser-side monitoring to detect XSS payload execution patterns
• Implement real-time alerting for CSP violation reports
• Regularly audit stored comments for potentially malicious markdown content

How to Mitigate CVE-2026-33500

Immediate Actions Required

• Upgrade WWBN AVideo to a version containing commit 3ae02fa240939dbefc5949d64f05790fd25d728d or later
• Audit existing comments in the database for potentially malicious markdown links
• Implement strict Content Security Policy headers to mitigate XSS impact
• Consider temporarily disabling markdown link functionality in comments until patched

Patch Information

A patch has been released in commit 3ae02fa240939dbefc5949d64f05790fd25d728d. This commit addresses the sanitization bypass by properly handling markdown link syntax. Organizations should apply this patch immediately. For detailed information, refer to the GitHub AVideo Commit Change and the GitHub Security Advisory GHSA-72h5-39r7-r26j.

Workarounds

• Implement server-side URL validation to block javascript:, data:, and vbscript: protocols in link URLs before storage
• Enable Parsedown's safeMode as a temporary measure while applying the official patch
• Deploy a Web Application Firewall (WAF) rule to strip or block comments containing potentially malicious URI schemes
• Restrict comment functionality to trusted users or disable markdown link parsing until the patch is applied

# Example CSP header configuration to mitigate XSS impact
# Add to web server configuration (Apache/Nginx)
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';