What is GHSA-cm9h-j76v-35pq?

GHSA-cm9h-j76v-35pq is a security advisory published by GitHub Security Advisories with Critical severity. AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site...

Which CVE IDs does GHSA-cm9h-j76v-35pq cover?

GHSA-cm9h-j76v-35pq covers the following CVE IDs: CVE-2026-89255. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cm9h-j76v-35pq?

GHSA-cm9h-j76v-35pq has a CVSS v3 base score of 8.7, published by GitHub Security Advisories.

GHSA-cm9h-j76v-35pqCriticalCVSS 8.7

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-89255 →

📋 Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-gq4h-vw2w-9rx3
https://nvd.nist.gov/vuln/detail/CVE-2026-89255
https://www.vulncheck.com/advisories/avideo-logincontrol-stored-xss-via-pgp-public-key
https://github.com/advisories/GHSA-cm9h-j76v-35pq