https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T11:56:14.394134+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-30451 EUVD-2026-30451 2026-10-09T11:56:14.399146+00:00 EUVD-2026-30451 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39183 fkie_cve-2021-39183 2026-10-09T11:56:14.399197+00:00

Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.

 https://cve.radiocsirt.org/vuln/ghsa-2hfj-cxw7-g45p GHSA-2hfj-cxw7-g45p — Unsafe inline XSS in pasting DOM element into chat 2026-10-09T11:56:14.399284+00:00

Affected: Go: github.com/owncast/owncast

### Impact

Inline scripts are executed when Javascript is parsed via a paste action.

1. Open https://watch.owncast.online/ 2. Copy and then paste `<img src=null onerror=alert('hello')>` into the chat field. 3. An alert should pop up.

### Patches ``` ⋮ 13 │ // Content security policy ⋮ 14 │ csp := []string{ ⋮ 15 │ "script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='", ⋮ 16 │ "worker-src 'self' blob:", // No single quotes around blob: ⋮ 17 │ } ```

Will be patched in 0.0.9 by blocking `unsafe-inline` Content Security Policy and specifying the `script-src`. The `worker-src` is required to be set to `blob` for the video player.

### For more information

If you have any questions or comments about this advisory: * Open an issue in [owncast/owncast](https://github.com/owncast/owncast/issues) * Email us at [gabek@real-ity.com](mailto:gabek@real-ity.com)

 https://cve.radiocsirt.org/vuln/gsd-2021-39183 gsd-2021-39183 2026-10-09T11:56:14.399375+00:00 gsd-2021-39183