Executive brief
ClipBucket is an open-source video hosting platform. A reflected cross-site scripting vulnerability in the sort_link() helper function allows attackers to inject malicious scripts into video listing pages through crafted links. Victims visiting these links could have their accounts compromised or have their session hijacked.
Technical details
The sort_link() helper function fails to sanitize the cat, sort, and time query parameters before reflecting them in HTML output, enabling reflected XSS attacks. An unauthenticated attacker can craft a malicious URL with JavaScript payloads in these parameters and trick users into clicking it. The injected script executes under the application origin with the victim's session privileges.
Affected products
- MacWarrior ClipBucket before 5.5.3-#182
Timeline
- 2026-09-22: disclosed