# Stored XSS on vimeo.com and player.vimeo.com
Hubnut Flash widget rendered the video owner's Name unescaped, letting a stored `![]()
` payload load an external SWF and run JS on vimeo.com and player.vimeo.com.
- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: stefanovettorazzi
- Disclosed: 2015-11-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/87577
- Library page: https://bugbountylibrary.com/r/h1%3A87577
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high vuln:xss
**Target:** Hubnut Flash widget (hubnut.swf) on vimeo.com and player.vimeo.com
**Root cause:** The Hubnut Flash file renders the video owner's Name without escaping it, so HTML/Flash markup in the profile Name is interpreted rather than displayed as text.
**Steps:**
1. Go to `https://vimeo.com/settings`.
2. Change your Name to `
`.
3. Click Save Changes.
4. Go to `https://vimeo.com/settings/profile` and note the Vimeo URL value (e.g. `user36690798`).
5. Visit `https://player.vimeo.com/hubnut/user/[value]` (e.g. `https://player.vimeo.com/hubnut/user/user36690798`).
6. `alert(document.domain)` executes.
7. Visit `https://vimeo.com/hubnut/user/[value]`; `alert(document.domain)` executes there too.
**How found:** Noticed the same Hubnut widget content is served on both vimeo.com/hubnut and player.vimeo.com/hubnut, then observed the Flash file renders the owner's Name without escaping, allowing an external SWF to be loaded via an img tag.
**Exploitation:** Attacker sets their profile Name to an `![]()
` tag pointing at a malicious SWF. When the Hubnut widget page is loaded (on either vimeo.com or player.vimeo.com), the unescaped Name is rendered, the img tag loads the external Flash file, and attacker-controlled JavaScript runs in the victim's browser on the Vimeo origin.
**Insight:** Legacy Flash widgets that render user profile fields (like display Name) into HTML often skip escaping; check whether the same widget is mirrored on multiple origins to widen impact.