The Bruce Video.js HLS Player up to version 1.0.2 contains a DOM-based cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to potentially execute malicious scripts in the context of the affected web application, impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5, reflecting a medium severity level. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected application or user data. The attack requires user interaction and low privileges, limiting the scope of impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when deploying the affected versions and consider applying input validation or sanitization controls at the application level if feasible.