CVE-2026-33035: Unauthenticated Reflected XSS via innerHTML in AVideo

March 17, 2026 (updated March 20, 2026)

AVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser. User input from a URL parameter flows through PHP’s json_encode() into a JavaScript function that renders it via innerHTML, bypassing encoding and achieving full script execution.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/cca6196f4072cb9acc39b1030fb8fb1702b4f69b
github.com/WWBN/AVideo/security/advisories/GHSA-wfq5-qgqp-hvhv
github.com/advisories/GHSA-wfq5-qgqp-hvhv
nvd.nist.gov/vuln/detail/CVE-2026-33035

Code Behaviors & Features

Detect and mitigate CVE-2026-33035 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →