{"id":"CVE-2026-77615","sourceIdentifier":"security-advisories@github.com","published":"2026-09-17T21:17:38.557","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"opencast","product":"opencast","versions":[{"version":"< 19.7","status":"affected"},{"version":">= 20.0, < 20.2","status":"affected"}]},{"vendor":"polimediaupv","product":"paella-player","versions":[{"version":"< 2.12.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T01:48:31.414907Z","id":"CVE-2026-77615","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40","source":"security-advisories@github.com"},{"url":"https://github.com/opencast/opencast/pull/7736","source":"security-advisories@github.com"},{"url":"https://github.com/opencast/opencast/releases/tag/19.7","source":"security-advisories@github.com"},{"url":"https://github.com/opencast/opencast/releases/tag/20.2","source":"security-advisories@github.com"},{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25","source":"security-advisories@github.com"},{"url":"https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b","source":"security-advisories@github.com"},{"url":"https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4","source":"security-advisories@github.com"},{"url":"https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21","source":"security-advisories@github.com"},{"url":"https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03","source":"security-advisories@github.com"},{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}