All vulnerabilities
CVE-2026-55690GHSA-c29q-5xm7-5p62

starcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

StarCitizenWiki starcitizenwiki/embedvideocomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published15 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

  • 4.1.0starcitizenwiki/embedvideo, composerGitHubcomposer require "starcitizenwiki/embedvideo:^4.1.0"
  • 4.1.0starcitizenwiki/embedvideo, PackagistOSVcomposer require "starcitizenwiki/embedvideo:^4.1.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name is not sanitized and can contain HTML.

Details

There is a hardcoded list of allowed services in a switch statement inside EmbedServiceFactory#newFromName here. When the service name is not known, an exception is thrown with the service name injected into the message via sprintf here. This message is not sanitized and is marked as isHtml here. Similarly with {{evl: here.

PoC

// Must be on a page, not on ExpandTemplates
{{#ev:<img src=x onerror=alert(document.domain)>|dQw4w9WgXcQ}}
{{#evl:id=dummy|service=<img src=x onerror=alert(document.domain)>}}

Impact

Stored XSS that allows arbitrary Javascript/HTML insertion on any page that a user can edit. It requires no interaction and executes in the wiki origin for every visitor to the page.

Text from GitHub Advisory Database

Affected versions 29

  • starcitizenwiki/embedvideo, composer<= 4.0.0GitHub
  • mediawiki-extensions-EmbedVideoaffected: < 4.1.0CVE List
  • starcitizenwiki/embedvideo, Packagistfrom first release, fixed in 4.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.1OSV
  • starcitizenwiki/embedvideo, Packagist3.0.2OSV
  • starcitizenwiki/embedvideo, Packagist3.0.3OSV
  • starcitizenwiki/embedvideo, Packagist3.0.4OSV
  • starcitizenwiki/embedvideo, Packagist3.0.5OSV
  • starcitizenwiki/embedvideo, Packagist3.0.6OSV
  • starcitizenwiki/embedvideo, Packagist3.0.7OSV
  • starcitizenwiki/embedvideo, Packagist3.0.8OSV
  • starcitizenwiki/embedvideo, Packagist3.0.9OSV
  • starcitizenwiki/embedvideo, Packagist3.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.1OSV
  • starcitizenwiki/embedvideo, Packagist3.2.2OSV
  • starcitizenwiki/embedvideo, Packagist3.2.3OSV
  • starcitizenwiki/embedvideo, Packagist3.2.4OSV
  • starcitizenwiki/embedvideo, Packagist3.2.5OSV
  • starcitizenwiki/embedvideo, Packagist3.2.6OSV
  • starcitizenwiki/embedvideo, Packagist3.2.7OSV
  • starcitizenwiki/embedvideo, Packagist3.2.8OSV
  • starcitizenwiki/embedvideo, Packagist3.3.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.1OSV
  • starcitizenwiki/embedvideo, Packagist3.4.2OSV
  • starcitizenwiki/embedvideo, Packagist3.4.3OSV
  • starcitizenwiki/embedvideo, Packagist4.0.0OSV

References 4