CVE-2026-33683: AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

March 25, 2026

A sanitization order-of-operations flaw in the user profile “about” field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xss_esc() function entity-encodes input before strip_specific_tags() can match dangerous HTML tags, and html_entity_decode() on output reverses the encoding, restoring the raw malicious HTML.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/7cfdc380dae1e56bbb5de581470d9e9957445df0
github.com/WWBN/AVideo/security/advisories/GHSA-ghx5-7jjg-q2j7
github.com/advisories/GHSA-ghx5-7jjg-q2j7
nvd.nist.gov/vuln/detail/CVE-2026-33683

Code Behaviors & Features

Detect and mitigate CVE-2026-33683 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →