关键信息总结 漏洞类型 Stored Cross-Site Scripting (XSS) - CWE-79 受影响的产品/版本 AVideo 18.0 根本原因总结 AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing URIs to be rendered as clickable links. 影响总结 An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. 解决/修复方案 The issue was confirmed and fixed in the master branch. An official release will be published soon. 临时解决办法 Until the release is available, validate and block unsafe URI schemes (e.g., ) before rendering Markdown, and enable Parsedown Safe Mode. 漏洞ID和严重性 Severity: High CVE ID: CVE-2026-27568 报告人 Reported by Arkadiusz Marta (https://github.com/arkmarta/)