VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 22 Oct 2025 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4. | |
| Title | VDO.Ninja Reflected XSS Vulnerability in control.html | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-22T20:52:57.758Z
Reserved: 2025-10-16T19:24:37.268Z
Link: CVE-2025-62613
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-22T21:15:46.837
Modified: 2025-10-22T21:15:46.837
Link: CVE-2025-62613
Redhat
No data.
OpenCVE Enrichment
No data.