Cross-site Scripting Vulnerability in Bruce Video.js HLS Player

CVE-2025-27325

Summary

The Video.js HLS Player, specifically versions up to 1.0.2, is susceptible to a DOM-Based Cross-site Scripting (XSS) vulnerability. This flaw stems from improper handling of input during the web page generation process, allowing malicious actors to inject harmful scripts into users' browsers. As a consequence, users may unknowingly execute these scripts, potentially leading to unauthorized access to sensitive information or manipulation of website content. It is crucial for users of Video.js HLS Player to review their security posture and apply necessary updates or mitigations.

References