CVE-2026-116139 Details
Description
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.
A stored cross-site scripting vulnerability has been identified in WWBN AVideo versions 26.0 through 29.3.0. This vulnerability allows authenticated commenters to inject JavaScript into comments, which is executed in the browsers of users viewing the comments, under the application origin. The issue arises because the function markDownToHTML() does not properly sanitize event-handler attributes in image tags, allowing malicious scripts to bypass inline sanitization and execute. The vulnerability was introduced in version 26.0 and persists through 29.3.0.
As of now, no official patch has been released for this vulnerability. However, users can disable comment submission or display for untrusted content, or apply a strict HTML allowlist that removes event attributes and unsafe URI schemes. Once a patch is available, it is recommended to update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/f13587c59346b4bf0f449273021d29b869594559 | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-cx46-26xc-2w7f | [email protected] | AdvisoryTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/wwbn-avideo-26.0-through-29.3.0-stored-xss-via-comment-markdown-rendering | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | >= 26.0, <= 29.3.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |