CVE-2026-77615Paella Player: Stored XSS via caption cue text
Updated under an hour ago ()
Does this affect you?
It affects opencast and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
- CVSS
- 8.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Sep 22, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
opencast opencast opencast:opencast (from the name) | before 19.7; from 20.0, < 20.2 | CNA record |
polimediaupv paella-player polimediaupv:paella_player (from the name) | before 2.12.11 | CNA record |
References
- https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25x-refsource-confirm
- https://github.com/opencast/opencast/pull/7736x-refsource-misc
- https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40x-refsource-misc
- https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206bx-refsource-misc
- https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4x-refsource-misc
- https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03x-refsource-misc
- https://github.com/opencast/opencast/releases/tag/19.7x-refsource-misc
- https://github.com/opencast/opencast/releases/tag/20.2x-refsource-misc
- https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.