PT-2026-27186 · Avideo · Avideo

Restriction · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33683

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description A flaw exists in the order of operations during sanitization of the user profile "about" field. This allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xss esc() function entity-encodes input before the strip specific tags() function can identify and remove dangerous HTML tags. Subsequently, the html entity decode() function reverses the encoding on output, restoring the original malicious HTML.

Recommendations Update to a version after 26.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33683

GHSA-GHX5-7JJG-Q2J7

Affected Products

Avideo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33683.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ghx5-7jjg-q2j7 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/7cfdc380dae1e56bbb5de581470d9e9957445df0 · Patch
• https://osv.dev/vulnerability/GHSA-ghx5-7jjg-q2j7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33683 · Security Note
• https://github.com/WWBN/AVideo · Note