{"action":"Upgrade paella-core to 1.50.6 or later.","affected":[{"fixed":"1.50.6","introduced":"0"}],"component":"paella-core","cve_ids":["CVE-2026-77615"],"ecosystem":"npm","epss":0.00559,"exploited":false,"fixed_versions":["1.50.6"],"ghsa_id":"GHSA-m6c8-jcw2-5r25","id":"tcs_01M5KFZT3Z392WN8G7P4KPBDW6","modified_at":"2026-09-18T13:30:05.758061179Z","published_at":"2026-09-18T13:11:59Z","references":["https://osv.dev/vulnerability/GHSA-m6c8-jcw2-5r25","https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25","https://nvd.nist.gov/vuln/detail/CVE-2026-77615","https://github.com/opencast/opencast/pull/7736","https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40","https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b","https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4","https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03","https://github.com/opencast/opencast","https://github.com/opencast/opencast/releases/tag/19.7","https://github.com/opencast/opencast/releases/tag/20.2","https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-m6c8-jcw2-5r25","url":"https://osv.dev/vulnerability/GHSA-m6c8-jcw2-5r25"}],"summary":"Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text"}