Vulnerability-Lookup

GHSA-M6C8-JCW2-5R25

Vulnerability from github – Published: 2026-09-18 13:11 – Updated: 2026-09-18 13:12

Summary

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Details

Summary

The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears _captionsContainer.innerHTML and then appends each active cue with _captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the Opencast origin.

The caption track is read from any media package element with a captions/* flavor and is served, with the player manifest, to anonymous viewers through /search/episode.json. The caption plugins that consume it are enabled in the default player configuration, the "Subtitles" upload that produces a captions/source track is active by default, and no caption processing step escapes the cue text.

A user who can upload a subtitle to an event and publish it stores the payload in the published caption file. Any viewer who opens the event and turns captions on runs the script.

Result: a non-admin content author stores JavaScript in a subtitle cue that executes in the browser session of every viewer who enables captions on that event, including anonymous viewers and authenticated staff.

Affected

opencast/opencast, engage-paella-player module. Supported release lines 19.x and 20.x are affected (and 18.x). Live-confirmed on 18.8 (Paella 7, paella-core 1.50.2) and 20.0 (Paella 8, paella-core 1.50.4); 19.5 ships the code-identical caption path (paella-core 1.50.4, same EpisodeConversor and default plugin config as 20.0). The captions canvas uses the same innerHTML += cue sink across these versions. Default configuration: the WebVTT and DFXP caption plugins are enabled: true in etc/ui-config/mh_default_org/paella7/config.json, the "Subtitles" upload option (captions/source, .vtt) is active in etc/listproviders/event.upload.asset.options.properties, and the fast workflow publishes captions/* to the engage player. Condition: an event with a caption track published to the engage player. No non-default flag required.

Root cause

The captions canvas appends each cue to _captionsContainer.innerHTML in the bundled paella-core (served at /paellaN/ui/paella-player.js / the 20.x core chunk), so markup in a cue becomes live DOM. The caption entry is built from any media package element whose flavor matches captions/* at modules/engage-paella-player-7/src/js/EpisodeConversor.js:392, and /search/episode.json serves the manifest and the caption file to anonymous clients. The WebVTT and DFXP plugins that consume it are enabled by default at etc/ui-config/mh_default_org/paella7/config.json:571 and :574. The cue text is not HTML-escaped before assignment to innerHTML, and partial-process-uploaded-captions only cuts and tags the file, it never sanitizes it. Opencast sets neither a Content-Security-Policy nor an X-Content-Type-Options header, so the injected script runs without restriction.

Reproduction

Default config, default caption plugins enabled, a non-admin user with ROLE_API_EVENTS_CREATE, ROLE_API_EVENTS_TRACK_EDIT, and ROLE_UI_TASKS_CREATE (no ROLE_ADMIN).

As the non-admin user, create an event, then upload a WebVTT subtitle as captions/source whose cue text is an XSS payload, and publish the event.

WEBVTT

00:00:00.000 --> 00:00:30.000
<img src=x onerror=document.title=window.__xss=document.domain>

The anonymous search manifest then exposes the caption and serves the cue raw.

GET /search/episode.json?id=<event>
"type":"captions/source", "url":".../static/.../x.vtt"
GET .../static/.../x.vtt  ->  cue text returned verbatim

Open the event in the player as an anonymous viewer, open the captions menu, and select the track; the cue is written to innerHTML and the onerror handler runs.

Live-verified: on Opencast 18.8 (build 8705223) in Chrome, a non-admin author published the subtitle and an anonymous viewer enabled captions, rendering the cue as a live <img> node and setting window.__xss and document.title to document.domain. On Opencast 20.0 (build d919405, Paella 8), the served core bundle contains the identical innerHTML += cue sink and the player loads the cue raw; the sink executes JavaScript in the engage origin when fed the player's own published caption file.

Impact

JavaScript execution in the Opencast origin in the session of any viewer who enables captions on the event.
Anonymous viewers and authenticated staff are equally affected; an instructor or admin viewer exposes that session context to the script.
Session and CSRF-token theft, actions performed as the victim against the Opencast REST API.
Stored by a non-admin content author, triggered by viewing with captions on, no attacker authentication at view time.

Credit

Jan Kahmen, turingpoint (jan@turingpoint.de)

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opencastproject:opencast-engage-paella-player-7"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opencastproject:opencast-engage-paella-player-7"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0"
            },
            {
              "fixed": "20.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "paella-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.50.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77615"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T13:11:59Z",
    "nvd_published_at": "2026-09-17T21:17:38Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe Opencast Paella player renders caption cue text into `innerHTML` without escaping. The captions canvas clears `_captionsContainer.innerHTML` and then appends each active cue with `_captionsContainer.innerHTML += cue`, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the Opencast origin.\n\nThe caption track is read from any media package element with a `captions/*` flavor and is served, with the player manifest, to anonymous viewers through `/search/episode.json`. The caption plugins that consume it are enabled in the default player configuration, the \"Subtitles\" upload that produces a `captions/source` track is active by default, and no caption processing step escapes the cue text.\n\nA user who can upload a subtitle to an event and publish it stores the payload in the published caption file. Any viewer who opens the event and turns captions on runs the script.\n\nResult: a non-admin content author stores JavaScript in a subtitle cue that executes in the browser session of every viewer who enables captions on that event, including anonymous viewers and authenticated staff.\n\n## Affected\n\nopencast/opencast, `engage-paella-player` module. Supported release lines 19.x and 20.x are affected (and 18.x). Live-confirmed on 18.8 (Paella 7, paella-core 1.50.2) and 20.0 (Paella 8, paella-core 1.50.4); 19.5 ships the code-identical caption path (paella-core 1.50.4, same `EpisodeConversor` and default plugin config as 20.0). The captions canvas uses the same `innerHTML += cue` sink across these versions.\nDefault configuration: the WebVTT and DFXP caption plugins are `enabled: true` in `etc/ui-config/mh_default_org/paella7/config.json`, the \"Subtitles\" upload option (`captions/source`, `.vtt`) is active in `etc/listproviders/event.upload.asset.options.properties`, and the `fast` workflow publishes `captions/*` to the engage player.\nCondition: an event with a caption track published to the engage player. No non-default flag required.\n\n## Root cause\n\nThe captions canvas appends each cue to `_captionsContainer.innerHTML` in the bundled paella-core (served at `/paellaN/ui/paella-player.js` / the 20.x core chunk), so markup in a cue becomes live DOM. The caption entry is built from any media package element whose flavor matches `captions/*` at `modules/engage-paella-player-7/src/js/EpisodeConversor.js:392`, and `/search/episode.json` serves the manifest and the caption file to anonymous clients. The WebVTT and DFXP plugins that consume it are enabled by default at `etc/ui-config/mh_default_org/paella7/config.json:571` and `:574`. The cue text is not HTML-escaped before assignment to `innerHTML`, and `partial-process-uploaded-captions` only cuts and tags the file, it never sanitizes it. Opencast sets neither a Content-Security-Policy nor an X-Content-Type-Options header, so the injected script runs without restriction.\n\n## Reproduction\n\nDefault config, default caption plugins enabled, a non-admin user with `ROLE_API_EVENTS_CREATE`, `ROLE_API_EVENTS_TRACK_EDIT`, and `ROLE_UI_TASKS_CREATE` (no `ROLE_ADMIN`).\n\n1. As the non-admin user, create an event, then upload a WebVTT subtitle as `captions/source` whose cue text is an XSS payload, and publish the event.\n\n```\nWEBVTT\n\n00:00:00.000 --\u003e 00:00:30.000\n\u003cimg src=x onerror=document.title=window.__xss=document.domain\u003e\n```\n\n2. The anonymous search manifest then exposes the caption and serves the cue raw.\n\n```\nGET /search/episode.json?id=\u003cevent\u003e\n\"type\":\"captions/source\", \"url\":\".../static/.../x.vtt\"\nGET .../static/.../x.vtt  -\u003e  cue text returned verbatim\n```\n\n3. Open the event in the player as an anonymous viewer, open the captions menu, and select the track; the cue is written to `innerHTML` and the `onerror` handler runs.\n\nLive-verified: on Opencast 18.8 (build 8705223) in Chrome, a non-admin author published the subtitle and an anonymous viewer enabled captions, rendering the cue as a live `\u003cimg\u003e` node and setting `window.__xss` and `document.title` to `document.domain`. On Opencast 20.0 (build d919405, Paella 8), the served core bundle contains the identical `innerHTML += cue` sink and the player loads the cue raw; the sink executes JavaScript in the engage origin when fed the player\u0027s own published caption file.\n\n## Impact\n\n- JavaScript execution in the Opencast origin in the session of any viewer who enables captions on the event.\n- Anonymous viewers and authenticated staff are equally affected; an instructor or admin viewer exposes that session context to the script.\n- Session and CSRF-token theft, actions performed as the victim against the Opencast REST API.\n- Stored by a non-admin content author, triggered by viewing with captions on, no attacker authentication at view time.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://www.turingpoint.de) (jan@turingpoint.de)",
  "id": "GHSA-m6c8-jcw2-5r25",
  "modified": "2026-09-18T13:12:00Z",
  "published": "2026-09-18T13:11:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77615"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/pull/7736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opencast/opencast"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/releases/tag/19.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/releases/tag/20.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text"
}

CVE-2026-77615 (GCVE-0-2026-77615)

Vulnerability from cvelistv5 – Published: 2026-09-17 20:51 – Updated: 2026-09-18 13:10

Title

Paella Player: Stored XSS via caption cue text

Summary

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/opencast/opencast/security/adv…	x_refsource_CONFIRM
https://github.com/opencast/opencast/pull/7736	x_refsource_MISC
https://github.com/opencast/opencast/commit/70168…	x_refsource_MISC
https://github.com/polimediaupv/paella-core/commi…	x_refsource_MISC
https://github.com/polimediaupv/paella-core/commi…	x_refsource_MISC
https://github.com/polimediaupv/paella-player/com…	x_refsource_MISC
https://github.com/opencast/opencast/releases/tag/19.7	x_refsource_MISC
https://github.com/opencast/opencast/releases/tag/20.2	x_refsource_MISC
https://github.com/polimediaupv/paella-player/blo…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
opencast	opencast	Affected: < 19.7 Affected: >= 20.0, < 20.2
polimediaupv	paella-player	Affected: < 2.12.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "opencast",
          "vendor": "opencast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 19.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0, \u003c 20.2"
            }
          ]
        },
        {
          "product": "paella-player",
          "vendor": "polimediaupv",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.12.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T13:10:43.631Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25"
        },
        {
          "name": "https://github.com/opencast/opencast/pull/7736",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencast/opencast/pull/7736"
        },
        {
          "name": "https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40"
        },
        {
          "name": "https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b"
        },
        {
          "name": "https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4"
        },
        {
          "name": "https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03"
        },
        {
          "name": "https://github.com/opencast/opencast/releases/tag/19.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencast/opencast/releases/tag/19.7"
        },
        {
          "name": "https://github.com/opencast/opencast/releases/tag/20.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencast/opencast/releases/tag/20.2"
        },
        {
          "name": "https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21"
        }
      ],
      "source": {
        "advisory": "GHSA-m6c8-jcw2-5r25",
        "discovery": "UNKNOWN"
      },
      "title": "Paella Player: Stored XSS via caption cue text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77615",
    "datePublished": "2026-09-17T20:51:26.147Z",
    "dateReserved": "2026-08-20T20:52:01.926Z",
    "dateUpdated": "2026-09-18T13:10:43.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-M6C8-JCW2-5R25

Summary

Affected

Root cause

Reproduction

Impact

Credit

CVE-2026-77615 (GCVE-0-2026-77615)

Tags

Sightings

Nomenclature

Related by attack behaviour