THREAT OPS › Threat News › [GHSA] GHSA-m6c8-jcw2-5r25 (high) — Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
[GHSA] GHSA-m6c8-jcw2-5r25 (high) — Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
GHSA-m6c8-jcw2-5r25 Severity: high CVE: CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
## Summary
The Opencast Paella player renders caption cue text into `innerHTML` without escaping. The captions canvas clears `_captionsContainer.innerHTML` and then appends each active cue with `_captionsContainer.innerHTML += cue`, so HTML inside a WebVTT or DFXP cue be
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-77615cve
- https://www.turingpoint.deurl
- jan@turingpoint.deemail
Original source: https://github.com/advisories/GHSA-m6c8-jcw2-5r25