In versions of BigBlueButton before 3.0.19, chat messages posted by users in a recording are stored without sanitization. When a recipient plays back the recording, the unsanitized content is rendered in the browser, allowing a malicious actor to inject and execute arbitrary JavaScript. An attacker can capture session cookies, deface the page, or perform other client‑side attacks, although the vulnerability does not grant direct access to server‑side resources.

The vulnerability affects BigBlueButton’s playback component (bbb‑playback) and the main BigBlueButton application for any release prior to 3.0.19. Blindside Networks’ Scalelite component is also listed as affected, though no specific version range is specified; it should be updated to the latest release to avoid compatibility issues.

The CVSS score of 6.5 indicates a moderate impact. With no EPSS score available and the issue not listed in KEV, exploitation likelihood is uncertain but feasible. An attacker needs only to place a malicious chat message into a recording; any user listening to the playback will be exposed to the injected script. There are no known server‑side prerequisites beyond the ability to submit a chat message for a recording.