CVE-2026-77615 json
Paella Player: Stored XSS via caption cue text
published last mo. modified last mo. also EUVD-2026-82473 , GHSA-m6c8-jcw2-5r25
- cvss
- 8.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
Patch / fix
- maven org.opencastproject:opencast-engage-paella-player-7 19.7, 20.2
- npm paella-core 1.50.6
- apereo opencast 19.7, 20.2
- polimediaupv paella-player 2.12.11
- github.com/opencast/opencast@701682c commit
- github.com/polimediaupv/paella-core@94a3649 commit
- github.com/polimediaupv/paella-core@9b2f14e commit
- github.com/polimediaupv/paella-player@6fe4af7 commit
- github.com/opencast/opencast#7736 pull request
- github.com/opencast/opencast/releases/tag/19.7 release
- github.com/opencast/opencast/releases/tag/20.2 release
Is CVE-2026-77615 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| GitHub | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opencastproject:opencast-engage-paella-player-7 | <19.7 >=20.0, <20.2 |
19.7 20.2 |
| npm | paella-core | <1.50.6 |
1.50.6 |
Affected products
- opencast opencast
- polimediaupv paella-player
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/opencast/opencast/pull/7736
web
-
github.com
/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40
web
-
github.com
/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b
web
-
github.com
/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4
web
-
github.com
/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03
web
-
github.com
/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25
exploit, web
-
github.com
/opencast/opencast/releases/tag/19.7
web
-
github.com
/opencast/opencast/releases/tag/20.2
web
-
github.com
/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-77615
advisory
-
github.com
/opencast/opencast
package
Sources
- CVE List CVE-2026-77615
- GitHub Advisory GHSA-m6c8-jcw2-5r25
- NVD CVE-2026-77615
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.