CVE-2026-27568

WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. Version 21.0 contains a fix. As a workaround, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.

• CWE-79

• https://github.com/WWBN/AVideo/commit/ade348ed6d28b3797162c3d9e98054fb09ec51d7Patch
• https://github.com/WWBN/AVideo/releases/tag/21.0Release Notes
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rcqw-6466-3mv7Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27541Incorrect Privilege Assignment vulnerability in Josh Kohlbac…7.2
• CVE-2026-27542Incorrect Privilege Assignment vulnerability in Rymera Web C…9.8
• CVE-2026-27545OpenClaw versions prior to 2026.2.26 contain an approval byp…4.7
• CVE-2026-2756A security vulnerability has been detected in OmniPEMF NeoRh…5
• CVE-2026-27566OpenClaw versions prior to 2026.2.22 contain an allowlist by…8.8
• CVE-2026-27567Payload is a free and open source headless content managemen…4.8
• CVE-2026-2757Incorrect boundary conditions in the WebRTC: Audio/Video com…9.8
• CVE-2026-27570Discourse is an open-source discussion platform. Prior to ve…6.1
• CVE-2026-27571NATS-Server is a High-Performance server for NATS.io, a clou…7.5
• CVE-2026-27572Wasmtime is a runtime for WebAssembly. Prior to versions 24.…7.5
• CVE-2026-27573Rejected reason: Further research determined the situation d…
• CVE-2026-27574OneUptime is a solution for monitoring and managing online s…9.9