CVE-2026-45578

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.

• CWE-78

• https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2rMitigation, Vendor Advisory

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45572Decidim is a participatory democracy framework. Prior to 0.3…4.8
• CVE-2026-45573Decidim is a participatory democracy framework. Prior to 0.3…6.4
• CVE-2026-45574epa4all-client is the Java Client for epa4all / ePA 3.0 in t…8.1
• CVE-2026-45575epa4all-client is the Java Client for epa4all / ePA 3.0 in t…7.4
• CVE-2026-45576zrok is software for sharing web services, files, and networ…7.5
• CVE-2026-45577Neotoma provides versioned records that persist across agent…6.9
• CVE-2026-4558A flaw has been found in Linksys MR9600 2.0.6.206937. Affect…8.8
• CVE-2026-45580WWBN AVideo is an open source video platform. In 29.0 and ea…5.4
• CVE-2026-45581fabric-chaincode-java is a Java based implementation of Hype…5.5
• CVE-2026-45582n8n-MCP is an MCP server that provides AI assistants access …6.5
• CVE-2026-45583Improper control of generation of code ('code injection') in…8.1
• CVE-2026-45584Heap-based buffer overflow in Microsoft Defender allows an u…8.1