{"answers":{"affected":"2 open source packages ship an affected version, including WWBN/AVideo.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54458 exists.","fix":"Upgrade WWBN/AVideo to 29.1.0 or later.","what":"CVE-2026-54458 is a critical cross-site scripting vulnerability in WWBN AVideo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-54458 and fix it if it is affected.\n\nWhat it is: CVE-2026-54458 is a critical cross-site scripting vulnerability in WWBN AVideo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54458 exists.\n\nAffected packages and fixed versions:\n- WWBN/AVideo (Packagist): affected all versions; fixed in 29.1.0\n- WWBN/AVideo (Packagist): affected all versions; fixed in 29.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54458/ (Markdown: https://insights.sbomify.com/CVE-2026-54458/index.md)","id":"CVE-2026-54458","markdown":"https://insights.sbomify.com/CVE-2026-54458/index.md","name":"CVE-2026-54458","record":{"aliases":["GHSA-8whc-2wmv-ww35"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"AVideo video platform","requires_auth":"none","summary":"Unauthenticated attackers can execute arbitrary JavaScript in admin sessions via the YPTSocket plugin, leading to full administrative takeover.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.6,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including \u003cimg\u003e with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin","id":"CVE-2026-54458","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"FileRise: Missing CSRF enforcement for file creation and share-link creation","id":"CVE-2026-54459"},"packages":[{"ecosystem":"Packagist","fixed":["29.1.0"],"introduced":["0"],"last_affected":[],"package":"WWBN/AVideo","purl":null,"source":"GHSA-8whc-2wmv-ww35"},{"ecosystem":"Packagist","fixed":["29.1.0"],"introduced":["0"],"last_affected":[],"package":"WWBN/AVideo","purl":"pkg:composer/WWBN/AVideo","source":"GHSA-8whc-2wmv-ww35"}],"prev":{"headline":"TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint","id":"CVE-2026-54457"},"products":["AVideo"],"published":"2026-07-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-16","vendors":["WWBN"]},"summary":"Unauthenticated attackers can execute arbitrary JavaScript in admin sessions via the YPTSocket plugin, leading to full administrative takeover.","url":"https://insights.sbomify.com/CVE-2026-54458/"}