Cross-site Scripting Vulnerability in Bruce Video.js HLS Player

CVE-2025-27325

What is CVE-2025-27325?

The Video.js HLS Player, specifically versions up to 1.0.2, is susceptible to a DOM-Based Cross-site Scripting (XSS) vulnerability. This flaw stems from improper handling of input during the web page generation process, allowing malicious actors to inject harmful scripts into users' browsers. As a consequence, users may unknowingly execute these scripts, potentially leading to unauthorized access to sensitive information or manipulation of website content. It is crucial for users of Video.js HLS Player to review their security posture and apply necessary updates or mitigations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References