THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-m6c8-jcw2-5r25 (high) — Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

[GHSA] GHSA-m6c8-jcw2-5r25 (high) — Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

highgithub_advisoriesPublished 2026-09-18

GHSA-m6c8-jcw2-5r25 Severity: high CVE: CVE-2026-77615

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

## Summary

The Opencast Paella player renders caption cue text into `innerHTML` without escaping. The captions canvas clears `_captionsContainer.innerHTML` and then appends each active cue with `_captionsContainer.innerHTML += cue`, so HTML inside a WebVTT or DFXP cue be

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-m6c8-jcw2-5r25