{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"29.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-43874"],"ecosystem":"Packagist","epss":0.00318,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-ghcv-22jf-vfxm","id":"tcs_01M5KF2S6AVCPR46K98F3MMF01","modified_at":"2026-05-13T14:33:40.912586Z","published_at":"2026-05-05T19:07:09Z","references":["https://osv.dev/vulnerability/GHSA-ghcv-22jf-vfxm","https://github.com/WWBN/AVideo/security/advisories/GHSA-ghcv-22jf-vfxm","https://nvd.nist.gov/vuln/detail/CVE-2026-43874","https://github.com/WWBN/AVideo/commit/9f3006f9a89a34daa67a83c6ad35f450cb91fcce","https://github.com/WWBN/AVideo","https://github.com/advisories/GHSA-gph2-j4c9-vhhr"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-ghcv-22jf-vfxm","url":"https://osv.dev/vulnerability/GHSA-ghcv-22jf-vfxm"}],"summary":"AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass"}