PT-2026-21341 · Parsedown+1 · Parsedown+1

Arkmarta · Published 2026-02-20 · Updated 2026-02-25 · CVE-2026-27568

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 21.0 AVideo version 18.0

Description AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing javascript: URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. The issue is a Stored Cross-Site Scripting (XSS) as defined by CWE-79.

Recommendations Versions prior to 21.0 should be updated to version 21.0 or later. For AVideo version 18.0, validate and block unsafe URI schemes (e.g., javascript:) before rendering Markdown. Enable Parsedown Safe Mode.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27568

GHSA-RCQW-6466-3MV7

Affected Products

Avideo

Parsedown

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27568.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rcqw-6466-3mv7 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/ade348ed6d28b3797162c3d9e98054fb09ec51d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27568 · Security Note
• https://osv.dev/vulnerability/GHSA-rcqw-6466-3mv7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27568 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/releases/tag/21.0 · Note
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://twitter.com/_cvereports/status/2026313835334824127 · Twitter Post
• https://twitter.com/CVEnew/status/2026676467527303615 · Twitter Post