Paella Player
Monthly
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.