CVSS 3.1
8.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NCVE-2026-77615
High (8.7). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.opencastproject:opencast-engage-paella-player-7 19.7, 20.2.
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m6c8-jcw2-5r25 | Maven | org.opencastproject:opencast-engage-paella-player-7 | <19.7 | 19.7 |
| GHSA-m6c8-jcw2-5r25 | Maven | org.opencastproject:opencast-engage-paella-player-7 | >=20.0 <20.2 | 20.2 |
| GHSA-m6c8-jcw2-5r25 | npm | paella-core | <1.50.6 | 1.50.6 |
References
- https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40
- https://github.com/opencast/opencast/pull/7736
- https://github.com/opencast/opencast/releases/tag/19.7
- https://github.com/opencast/opencast/releases/tag/20.2
- https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25