Advisory details:
github_osv / GHSA-2fhx-q92v-5fhv
| Advisory ID | github_osv/GHSA-2fhx-q92v-5fhv |
| Aliases |
CVE-2026-49279
|
| Summary | WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) # AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix ``` `MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all. ### Attack Chain - Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg` - The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched - `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true - The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML` ## Proof of Concept ```javascript // Connect to AVideo WebSocket as authenticated user const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN'); ws.onopen = () => { ws.send(JSON.stringify({ msg: "Hello", // sanitized path — decoy json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload to_users_id: VICTIM_USER_ID, resourceId: RESOURCE_ID })); }; // Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism ``` ## Impact An authenticated attacker can: - Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system - Steal session cookies and authentication tokens - Perform account takeover via session hijacking - Chain with CSRF to execute admin actions on behalf of the victim The vulnerability affects the default SQLite WebSocket backend configuration. ## Suggested Remediation Apply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`: ```php // Before (vulnerable — shallow strip): if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); } // After (fixed — recursive strip): $json = removeAutoEvalCodeOnHTMLRecursive($json); ``` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.9 |
| Risk | 3.5 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 7.7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2fhx-q92v-5fhv/GHSA-2fhx-q92v-5fhv.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-07-18T02:21:31Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/49xxx/CVE-2026-49279.json
Source Advisory: vulnrichment/CVE-2026-49279
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]