WWBN AVideo up to version 29.0 contains a code injection vulnerability (CWE-94) due to improper control of code generation. The vulnerability stems from a logic flaw in the server-side mitigation of the YPTSocket autoEvalCodeOnHTML eval sink. The mitigation only removes payloads under $json['msg'], but the relay function msgToResourceId() selects messages from $msg['json'], allowing an attacker to bypass the filter. An unauthenticated attacker can obtain a WebSocket token, connect to the WebSocket server, and send a message with malicious code nested under a top-level json field. This payload is delivered verbatim to logged-in users identified by to_users_id, and the client executes it via eval(), resulting in code injection. A commit (9f3006f9a89a34daa67a83c6ad35f450cb91fcce) reportedly contains a fix, but no official patch or advisory details are provided.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary code in the context of logged-in users via the WebSocket messaging system. This can lead to partial confidentiality and integrity loss (CVSS impact: Confidentiality Low, Integrity Low), but does not affect availability. The vulnerability enables cross-user code execution through client-side eval(), potentially compromising user sessions or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description references a commit containing an updated fix, but no official patch or vendor advisory is provided. Until an official fix is confirmed, restrict access to WebSocket tokens and monitor for unusual WebSocket activity. Avoid using affected versions (<= 29.0) in production environments where possible.