### Summary The incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link syntax to bypass sanitization. ### Affected Package - **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** < commit 3ae02fa24093 - **Patched versions:** >= commit 3ae02fa24093 ### Details In `objects/functionsSecurity.php`, the `ParsedownSafeWithLinks` class: - Overrides `blockMarkup()` -- blocks non-``/`` HTML tags - Overrides `inlineMarkup()` -- sanitizes `` and `

` in raw HTML, including an href whitelist But the base `Parsedown.php` class has two additional methods that generate `` tags: - `inlineLink()` (line ~1388) -- processes `[text](url)` markdown syntax, sets `href` = URL directly - `inlineUrlTag()` (line ~1558) -- processes `` auto-link syntax, sets `href` = URL directly Neither is overridden by `ParsedownSafeWithLinks`, so `[Click me](javascript:alert(document.cookie))` produces `Click me` without any sanitization. The fix sanitizes raw HTML `` tags via `inlineMarkup` but misses the markdown-native link syntax (`[text](url)`) and auto-link syntax (``) which produce `` tags through different code paths in the base Parsedown class. ### PoC ```python """ CVE-2026-33500 - Incomplete XSS fix in AVideo ParsedownSafeWithLinks Tests REAL vulnerable code from: objects/functionsSecurity.php (commit f154167, pre-fix 3ae02fa) vendor/erusev/parsedown/Parsedown.php The ParsedownSafeWithLinks class overrides: - blockMarkup (blocks non-a/img HTML) - inlineMarkup (sanitizes and inline HTML) - inlineLink is NOT overridden (markdown [text](url) syntax) But the base Parsedown class has inlineLink() at line 1388 which creates from markdown [text](url) without any href sanitization. Since ParsedownSafe