Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-11T12:16:56.003Z",
  "pubdate": "2026-09-11T12:16:56.003Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in the AVideo Bookmark plugin, affecting all versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability originates from the improper sanitization and output encoding of user-supplied chapter names within the bookmarking functionality.\nAn authenticated video owner can inject arbitrary JavaScript payloads into the bookmark name parameter, which are subsequently rendered in the HTML context of the public watch page.\nBecause the payload is stored server-side, it is automatically executed within the origin of the AVideo application whenever a victim accesses the affected video page.\nThis impact allows for session hijacking, unauthorized actions performed on behalf of the victim, and potential exfiltration of sensitive information or credentials.\nExploitation requires the attacker to have sufficient privileges to manage or edit video bookmarks, making this a high-risk vector for platforms allowing user-generated content or multiple content contributors.",
  "technicalDetails": "The root cause of this vulnerability is a failure to perform adequate context-aware output encoding when rendering bookmark chapter names in the AVideo public watch-page HTML template.\nThe application processes input for chapter names but fails to escape special characters, such as angle brackets, quotes, or script tags, before concatenating the data directly into the Document Object Model (DOM).\nAn authenticated user with video management privileges can manipulate the bookmark name field via an HTTP POST request to the bookmark plugin interface. By crafting a request that includes a malicious script payload (e.g., <script>alert(document.cookie)</script>), the attacker causes the application to persist the payload in the underlying database.\nWhen a legitimate user or administrator navigates to the public watch page for the corresponding video, the AVideo application retrieves the bookmark data from the database and inserts it into the HTML structure of the page without proper neutralization. This results in the browser interpreting the injected payload as executable script content rather than plain text data.\nBecause the execution occurs within the AVideo origin, the malicious script inherits full access to the victim's session tokens, document cookies, and the ability to make asynchronous requests to the AVideo API via the victim's browser, effectively bypassing same-origin policy (SOP) protections.\nThe attack flow is as follows: 1) The attacker authenticates to the platform; 2) The attacker submits a crafted bookmark name containing JavaScript to the plugin's endpoint; 3) The backend stores this unsanitized input in the database; 4) A victim visits the watch page; 5) The server injects the raw script into the HTML response; 6) The victim's browser executes the script in the context of the AVideo domain.\nThis vulnerability is classified as stored XSS due to the persistence of the payload. It impacts the integrity and confidentiality of user sessions and can lead to full account compromise if the victim is a privileged administrator."
}