CVE-2026-47694: WWBN AVideo: Stored XSS via unescaped Gallery category description

June 4, 2026

AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page.

This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.

References

github.com/WWBN/AVideo/commit/6a6ff1f5bff1904f91f612db9f0da083295392b1
github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2
github.com/advisories/GHSA-c8h8-vq34-9fw2
nvd.nist.gov/vuln/detail/CVE-2026-47694

Code Behaviors & Features

Detect and mitigate CVE-2026-47694 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →