EUVD-2026-82473
GHSA-m6c8-jcw2-5r25
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attacker needs caption-content access (PR:L) and a viewer must watch the captioned video (UI:R); XSS breaks out of the player into the origin (S:C) enabling session theft/actions (C:H/I:H), no availability impact (A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Paella Player is a set of libraries to create a multi stream video player. Prior to Paulla Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
AnalysisAI
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control closed-caption cue text rendered by Paella Player (versions prior to 2.12.11), i.e., the ability to supply or influence a subtitle/caption track (WebVTT/DFXP) attached to a video - in the Opencast context (<19.7, <20.2) this typically means an authenticated author/contributor with content-upload privileges (consistent with PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a client-side stored/DOM XSS (CWE-79) in Paella Player's closed-captions rendering path, confirmed by the vendor advisory (GHSA-m6c8-jcw2-5r25) and the source fix. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade Paella Player / paella-core to 2.12.11 (the paella-core 2.12.11 release and the corresponding @asicupv plugin versions that require ^2.12.10 or later), or, for Opencast users, upgrade to Opencast 19.7 or 20.2, which include the patched dependency set - see the advisory at https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25, the release pages https://github.com/opencast/opencast/releases/tag/19.7 and https://github.com/opencast/opencast/releases/tag/20.2, and the upstream fixes at https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03 and https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b (Opencast integration in PR https://github.com/opencast/opencast/pull/7736, commit 701682c635f668228c3e8fb7b4564b3294788e40). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Paella Player and Opencast deployment, record the exact paella-core and Opencast versions in use, and confirm which of them fall below paella-core 2.12.11, Opencast 19.7, or Opencast 20.2; meanwhile, temporarily restrict subtitle and caption track upload permissions to the smallest possible set of trusted authors and, where operationally feasible, disable display or ingestion of user-supplied caption tracks on the affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated high severity (CVSS 7.7), this vulner
In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated medium severity (CVSS 6.5), this vuln
Opencast is a free and open source solution for automated video capture and distribution. Rated medium severity (CVSS 6.
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new user
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume prope
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media
Session fixation in the default security configuration of Opencast prior to 19.7 and 20.2 lets an unauthenticated attack
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an add
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Rated
Opencast is free and open source software for automated video capture and distribution. Rated high severity (CVSS 7.5),
Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. Rated high s
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today