High, CVSS 8.7npmAmendedPublished
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
CVE-2026-77615 · GHSA-m6c8-jcw2-5r25
- Affected
- npm paella-core < 1.50.6
- Fixed in
- 1.50.6· Vendor fix available
- Issue
- The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears captionsContainer.innerHTML and then appends each active cue with captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the Opencast origin. The caption track is read from any media package element with a captions/ flavor and is served, with the player manifest, to anonymous viewers through /search/episode.json. The caption plugins that consume it are enabled in the default player configuration, the "Subtitles" upload that produces a captions/source track is active by default, and no caption processing step escapes the cue text. A user who can upload a subtitle to an event and publish it stores the payload in the published caption file. Any viewer who opens the event and turns captions on runs the script. Result: a non-admin content author stores JavaScript in a subtitle cue that executes in the browser session of…
Recommended action: Upgrade to 1.50.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.