The vulnerability arises from an incomplete sanitization within AVideo’s Markdown processing. The cleanup function that blocks raw HTML works, but it fails to intercept links built via inlineLink() or inlineUrlTag(). As a result, users can insert markdown links that reference javascript: URLs, which bypass the sanitizer and execute arbitrary script in the browser that visits the page. This could allow an attacker to steal session cookies, deface the site, or conceal phishing content, all without needing elevated privileges beyond content publishing.

The flaw exists in all AVideo releases up to and including version 29.0. The affected component is the ParsedownSafeWithLinks class, part of the public AVideo distribution from WWBN.

The CVSS score of 5.4 indicates a moderate risk profile. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation data. The attack vector is likely through user‑generated Markdown content; an attacker could embed a malicious link in posts, comments, or other free‑form fields that render Markdown. If a user with publishing rights can inject the payload, the XSS will trigger when any visitor views the page.