{"id":"CVE-2026-27737","aliases":["EUVD-2026-30811","GHSA-8vv7-vj94-q2pv"],"status":"published","title":"BigBlueButton has Stored XSS in bbb-playback replay","description":"BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00257,"percentile":0.17506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-05-18T21:11:17Z","modified":"2026-11-11T02:49:17Z","products":[{"vendor":"bigbluebutton","product":"bbb-playback"},{"vendor":"bigbluebutton","product":"bigbluebutton"},{"vendor":"blindsidenetworks","product":"scalite"}],"references":[{"url":"https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/bigbluebutton/bbb-playback/commit/09e89bfe4ff8488b68c3ff040d3081e419dc89b1","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/bigbluebutton/bigbluebutton/commit/69f45aa1b963dc7d80179d0155acc670aec5c4fc","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.19","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/blindsidenetworks/scalelite/releases/tag/v1.7.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27737.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27737","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27737","title":"BigBlueButton has Stored XSS in bbb-playback replay","description":"BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.","status":"published","published":"2026-05-18T21:11:17.611Z","modified":"2026-05-19T12:11:53.931Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-30811","description":"BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.","status":"published","published":"2026-05-18T21:11:17Z","modified":"2026-05-19T12:11:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:15.688012Z"}],"nvd":[{"id":"CVE-2026-27737","description":"BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.","status":"published","published":"2026-05-18T22:16:37.523Z","modified":"2026-07-24T13:10:00.223Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-27737","title":"BigBlueButton has Stored XSS in bbb-playback replay","description":"BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.","status":"published","published":"2026-05-18T21:11:17.611Z","modified":"2026-11-11T10:47:34.916750161Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T03:21:13.402158Z"}]}}