WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.

Affected: Packagist: wwbn/avideo

### Summary

The incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization.

### Affected Package

- **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** < commit 3ae02fa24093 - **Patched versions:** >= commit 3ae02fa24093

### Details

In `objects/functionsSecurity.php`, the `ParsedownSafeWithLinks` class: - Overrides `blockMarkup()` -- blocks non-`<a>`/`<img>` HTML tags - Overrides `inlineMarkup()` -- sanitizes `<a href=...>` and `<img src=...>` in raw HTML, including an href whitelist

But the base `Parsedown.php` class has two additional methods that generate `<a>` tags: - `inlineLink()` (line ~1388) -- processes `[text](url)` markdown syntax, sets `href` = URL directly - `inlineUrlTag()` (line ~1558) -- processes `<URL>` auto-link syntax, sets `href` = URL directly

Neither is overridden by `ParsedownSafeWithLinks`, so `[Click me](javascript:alert(document.cookie))` produces `<a href="javascript:alert(document.cookie)">Click me</a>` without any sanitization.

The fix sanitizes raw HTML `<a>` tags via `inlineMarkup` but misses the markdown-native link syntax (`[text](url)`) and auto-link syntax (`<url>`) which produce `<a>` tags through different code paths in the base Parsedown class.

### PoC

```python """ CVE-2026-33500 - Incomplete XSS fix in AVideo ParsedownSafeWithLinks

Tests…