# CVE-2026-27568: avideo XSS — Fixed in 21.0

🐘 Packagist

Not in CISA KEV

# CVE-2026-27568 — avideo

[Fix: WWBN/AVideo@ade348e](https://github.com/WWBN/AVideo/commit/ade348ed6d28b3797162c3d9e98054fb09ec51d7)

CVE-2026-27568 is a Cross-site Scripting (XSS) vulnerability in wwbn/avideo. A fix is available for wwbn/avideo — see the affected versions and patch details below.

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

Also known as[GHSA-rcqw-6466-3mv7](/vulnerability/GHSA-rcqw-6466-3mv7)

Published

Feb 24, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27568.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.3%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs18th percentile — riskier than 18% of all scored CVEsHighest risk

0.00%0.27%0.54%0.81%0.0%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐘`wwbn/avideo`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

### Vulnerability Type

Stored Cross-Site Scripting (XSS) — CWE-79.

### Affected Product/Versions

AVideo 18.0.

### Root Cause Summary

AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links.

### Impact Summary

An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration.

### Resolution/Fix

The issue was confirmed and fixed in the master branch. An official release will be published soon.

### Workarounds

Until the release is available, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.

### Credits/Acknowledgement

Reported by Arkadiusz Marta ([https://github.com/arkmarta/](https://github.com/arkmarta/)).

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`wwbn/avideo` 

all versions

21.0`composer require wwbn/avideo:^21.0`

## Affected Products

1 product · 1 configurations

Application

`avideo`wwbn

< 21.0

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wwbn/avideo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update wwbn/avideo to 21.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27568 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

\## Vulnerability Type Stored Cross-Site Scripting (XSS) — CWE-79. ## Affected Product/Versions AVideo 18.0. ## Root Cause Summary AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing \`javascript:\` URIs to be rendered as clickable links. ## Impact Summary An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeo

O3 Security · Impact-Aware SCA

### Is CVE-2026-27568 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)