Client-Side Injection Flaws Expose Sessions and Sensitive Data in AVideo and dom-sanitizer

Two newly disclosed web application flaws expose users to client-side data theft through content injection. In AVideo's TopMenu plugin, a stored cross-site scripting issue tracked as GHSA-GMPC-FXG2-VCMQ carries a CVSS 3.1 score of 6.1 and allows attackers to inject JavaScript that can read document.cookie, steal active session tokens, and impersonate users or administrators. Because the TopMenu component is rendered globally across the application, a malicious payload can execute for all site visitors, creating broad exposure and enabling follow-on attacks such as credential harvesting and fake login prompts.

A separate issue in rhukster/dom-sanitizer, tracked as GHSA-93VF-569F-22CQ, allows CSS injection through SVG style tags and is rated 4.7 under CVSS 3.1. The flaw can be exploited remotely without authentication when a victim renders a crafted SVG in a browser, potentially disclosing the victim's IP address, browser details, exact page URL, and sensitive DOM-resident data such as CSRF tokens or partial session identifiers. While the sanitizer flaw does not directly alter server-side state or disrupt availability, both disclosures highlight how server-side handling of untrusted content can be turned into browser-based theft of session and application data.