CVE-2026-77615: CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast

CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast

Vulnerability ID: CVE-2026-77615
CVSS Score: 8.7
Published: 2026-09-18

CVE-2026-77615 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in the Paella Player component, which is integrated as the default front-end media viewer in Opencast. Unsafe client-side rendering of subtitle tracks allows authenticated, low-privileged users to inject arbitrary JavaScript payloads via crafted WebVTT or DFXP files. The script executes within the context of any viewer session under the host origin, enabling session hijacking and unauthorized API interaction.

TL;DR

A Stored XSS vulnerability in Paella Player allows authenticated users to execute arbitrary JavaScript in the browsers of other users by uploading a crafted subtitle file.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
• Attack Vector: Network (AV:N)
• CVSS Base Score: 8.7 (High)
• Exploit Status: Proof-of-Concept Available
• KEV Status: Not Listed
• Impact: Arbitrary Client-side Script Execution (Stored XSS)
• Affected Component: CaptionsCanvas / DFXPParser / WebVTTParser

Affected Systems

• polimediaupv paella-player < 2.12.11
• polimediaupv paella-core < 1.50.5
• opencast opencast < 19.7
• opencast opencast >= 20.0, < 20.2
• paella-player: < 2.12.11 (Fixed in: 2.12.11)
• paella-core: < 1.50.5 (Fixed in: 1.50.5)
• opencast: < 19.7 (Fixed in: 19.7)
• opencast: >= 20.0, < 20.2 (Fixed in: 20.2)

Code Analysis

Commit: 6fe4af7

Fix XSS in CaptionsCanvas and DFXPParser by replacing innerHTML sinks with textContent and text nodes.

Commit: 94a3649

Introduce sanitizeHtml function in core DOM utility routines.

Commit: 9b2f14e

Integrate webvtt-parser NPM package for structured subtitle processing.

Commit: 701682c

Upgrade paella player dependencies to secure sub-versions in package config.

Exploit Details

• GitHub Security Advisory: Analysis of caption parsing flow and execution steps in vulnerable subtitle streams.

Mitigation Strategies

• Upgrade Paella Player and Opencast to patched versions
• Implement Content Security Policy (CSP)
• Enforce server-side sanitization on uploaded WebVTT and DFXP files

Remediation Steps:

1. Identify active instances of Opencast running versions below 19.7 or 20.2.
2. Apply the corresponding upgrades to deploy Paella Player 2.12.11 and paella-core 1.50.5.
3. Configure an HTTP response header to restrict resource execution: Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'.
4. Verify that media assets do not contain unescaped html tags prior to execution in custom applications.

References

• Advisory on Stored XSS in Paella Player
• Opencast Pull Request 7736
• Opencast Release 19.7
• Opencast Release 20.2

---

Read the full report for CVE-2026-77615 on our website for more details including interactive diagrams and full exploit analysis.