WWBN AVideo versions up to 29.0 contain a code injection vulnerability (CWE-94) due to improper control of code generation in the WebSocket message handling. The mitigation for the YPTSocket autoEvalCodeOnHTML eval sink only removes payloads under $json['msg'], but the relay function msgToResourceId() selects messages from $msg['json'], allowing crafted payloads to bypass filtering. An unauthenticated attacker can retrieve a WebSocket token, connect to the WebSocket server, and send malicious code nested under a top-level json field. This payload is relayed without stripping to logged-in users identified by to_users_id, where client-side eval() executes it. A commit (9f3006f9a89a34daa67a83c6ad35f450cb91fcce) contains an updated fix, but no official patch or advisory is documented.

An unauthenticated attacker can inject and execute arbitrary code in the context of logged-in users via the WebSocket interface. This can lead to partial confidentiality and integrity loss (CVSS impact: C:L/I:L/A:N). The vulnerability allows code execution on client browsers of authenticated users, potentially enabling further attacks such as session hijacking or data manipulation. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — no official vendor advisory or patch link is provided. A code fix has been committed in the source repository (commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce) that addresses the issue. Users should monitor the vendor's official channels for an official patch or update and apply it promptly once available. Until then, consider restricting access to the WebSocket endpoint or implementing additional filtering controls if feasible.