Executive brief
Opencast is a video management and distribution system widely used for lecture capture and online learning. The Paella video player component fails to sanitize caption text from WebVTT and DFXP subtitle files before displaying them, allowing a content author to embed malicious JavaScript in subtitles. When any viewer—including anonymous users and staff—enables captions on an event, the injected script executes in their browser session, enabling session hijacking, credential theft, and unauthorized API actions.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Paella player's caption rendering logic. The root cause is in the captions canvas code, which appends caption cues directly to innerHTML without HTML-escaping: `_captionsContainer.innerHTML += cue`. Caption files (WebVTT or DFXP format) are loaded from media package elements with a `captions/*` flavor and served to all viewers via the `/search/episode.json` endpoint. The attack requires a non-admin user with event creation, track editing, and task creation permissions to upload a malicious subtitle file as `captions/source` and publish the event. When any viewer enables captions, the unescaped HTML executes in the Opencast origin context, compromising the viewer's session and CSRF tokens. Patches are available in versions 19.7 and 20.2.
Affected products
- Opencast Opencast 18.x, 19.x before 19.7, 20.x before 20.2
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Patches released for versions 19.7 and 20.2