CVE-2021-39183: Unsafe inline XSS Owncast

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-14 · updated 2026-06-17
Weakness: CWE-79

Description

Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.

Affected products

owncast: before 0.0.9 — fixed in 0.0.9

How to fix

Upgrade to a fixed version: owncast 0.0.9. Check the vendor advisory for mitigations.

References

https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p
https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p

Get alerted when CVE-2021-39183 or the next vulnerability affects your stack