WWBN AVideo, an open source video platform, contains a cross-site scripting vulnerability in versions 29.0 and earlier. The vulnerability stems from an incomplete sanitization fix in the ParsedownSafeWithLinks class, which overrides inlineMarkup for raw HTML but fails to override inlineLink() and inlineUrlTag(). This omission allows javascript: URLs embedded in markdown link syntax to bypass sanitization controls, enabling potential script injection. A commit (cae8f0dadbdd962c89b91d0095c76edb8aadcacf) reportedly contains an updated fix, but no official patch status is provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The commit referenced suggests a fix exists in the source code repository, so users should monitor WWBN's official channels for an official patch or update. Until then, cautious handling of markdown input and limiting user privileges may reduce risk.