WWBN AVideo is an open-source video platform that prior to version 21.0 allowed users to post comments containing Markdown. The platform uses Parsedown v1.7.4 to parse Markdown but does not enable its Safe Mode feature, which is designed to prevent unsafe content. This lack of sanitization allows an authenticated low-privilege attacker to embed malicious JavaScript code within Markdown links using unsafe URI schemes such as 'javascript:'. These malicious links are rendered as clickable in the comments section, enabling persistent cross-site scripting (XSS). When other users click these links, the injected JavaScript executes in their browsers, potentially allowing attackers to hijack user sessions, escalate privileges to administrative levels, and exfiltrate sensitive data. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires the attacker to be authenticated with low privileges and requires victim user interaction (clicking the malicious link). The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The fix in version 21.0 involves enabling Parsedown Safe Mode and validating/blocking unsafe URI schemes before rendering Markdown. No known exploits are reported in the wild as of now.

This vulnerability can significantly impact organizations using WWBN AVideo versions prior to 21.0 by enabling attackers to perform persistent XSS attacks. The consequences include session hijacking, which can lead to unauthorized access to user accounts, including administrative accounts if privilege escalation is successful. This compromises the confidentiality and integrity of user data and platform content. Data exfiltration risks threaten sensitive information leakage. The persistent nature of the XSS means the malicious payload remains in comments, potentially affecting many users over time. Although exploitation requires authentication and user interaction, the low privilege needed to inject malicious content broadens the attacker base. Organizations relying on AVideo for video hosting and community engagement may face reputational damage, user trust erosion, and compliance issues if exploited. The medium severity score reflects the moderate ease of exploitation combined with significant potential impact on user security and platform integrity.

To mitigate this vulnerability, organizations should upgrade WWBN AVideo to version 21.0 or later, where Parsedown Safe Mode is enabled and unsafe URI schemes are properly sanitized. Until upgrading is possible, administrators should implement input validation to explicitly block unsafe URI schemes such as 'javascript:', 'data:', and other potentially dangerous protocols in Markdown links within comments. Enabling Parsedown Safe Mode manually, if feasible, will reduce the risk of unsafe content rendering. Additionally, applying Content Security Policy (CSP) headers can help mitigate the impact of XSS by restricting the execution of inline scripts and untrusted sources. Monitoring user comments for suspicious links and educating users about the risks of clicking unknown links can further reduce exploitation chances. Regularly auditing and sanitizing user-generated content and limiting comment posting privileges to trusted users can also help contain risk.