{"id":"CVE-2026-49279","aliases":["GHSA-2fhx-q92v-5fhv"],"url":"https://o3.security/vulnerability/CVE-2026-49279","summary":"WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)","details":"# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler\n\n## Summary\n\nAVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely.\n\n\n## Affected Versions\n\nAVideo <= latest\n\n## Vulnerability Details\n\n### Root Cause: Shallow sanitization only covers `$json['msg']`\n\n`plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix:\n\n```php\nif (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') {\n    if (is_array($json['msg'] ?? null)) {\n        unset($json['msg']['autoEvalCodeOnHTML']);  // Only strips from $json['msg']\n    }\n}\n```\n\n`plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`:\n\n```php\nif (!empty($msg['json'])) {\n    $obj['msg'] = $msg['json'];       // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped\n} else if (!empty($msg['msg'])) {\n    $obj['msg'] = $msg['msg'];        // Only this path was sanitized\n} else {\n    $obj['msg'] = $msg;\n}\n```\n\nCompare with the correctly patched `Message.php` (lines 254-256):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Strips from ALL nested paths\n```\n\nAnd `MessageSQLiteV2.php` (lines 302-303):\n\n```php\n$json = removeAutoEvalCodeOnHTMLRecursive($json);  // Same recursive fix\n```\n\n`MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all.\n\n### Attack Chain\n\n- Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg`\n- The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched\n- `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true\n- The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML`\n\n## Proof of Concept\n\n```javascript\n// Connect to AVideo WebSocket as authenticated user\nconst ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN');\n\nws.onopen = () => {\n  ws.send(JSON.stringify({\n    msg: \"Hello\",                               // sanitized path — decoy\n    json: {autoEvalCodeOnHTML: \"alert('XSS')\"},  // unsanitized path — payload\n    to_users_id: VICTIM_USER_ID,\n    resourceId: RESOURCE_ID\n  }));\n};\n// Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism\n```\n\n## Impact\n\nAn authenticated attacker can:\n\n- Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system\n- Steal session cookies and authentication tokens\n- Perform account takeover via session hijacking\n- Chain with CSRF to execute admin actions on behalf of the victim\n\nThe vulnerability affects the default SQLite WebSocket backend configuration.\n\n## Suggested Remediation\n\nApply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`:\n\n```php\n// Before (vulnerable — shallow strip):\nif (is_array($json['msg'] ?? null)) {\n    unset($json['msg']['autoEvalCodeOnHTML']);\n}\n\n// After (fixed — recursive strip):\n$json = removeAutoEvalCodeOnHTMLRecursive($json);\n```","published":"2026-07-15T20:57:21.381Z","modified":"2026-08-12T03:51:28.393387426Z","cvss":null,"epss":{"score":0.0054,"percentile":0.44109,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":null}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23","label":"WWBN/AVideo@3e0b3ce"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49279.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49279"},{"type":"FIX","url":"https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.393387426Z"}}