All vulnerabilities
CVE-2026-55691GHSA-7h5p-637f-jfr7

starcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

StarCitizenWiki starcitizenwiki/embedvideocomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published15 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

  • 4.1.0starcitizenwiki/embedvideo, composerGitHubcomposer require "starcitizenwiki/embedvideo:^4.1.0"
  • 4.1.0starcitizenwiki/embedvideo, PackagistOSVcomposer require "starcitizenwiki/embedvideo:^4.1.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

Details

The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.

$template = <<<HTML
    <figure class="%s" data-service="%s" %s %s>
        <div class="embedvideo-wrapper" %s>%s%s%s</div>%s
    </figure>
HTML;

PoC

Note the double quote immediately following the single quote to escape the class attribute in the template:

<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>

Impact

Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.

Text from GitHub Advisory Database

Affected versions 29

  • starcitizenwiki/embedvideo, composer<= 4.0.0GitHub
  • mediawiki-extensions-EmbedVideoaffected: < 4.1.0CVE List
  • starcitizenwiki/embedvideo, Packagistfrom first release, fixed in 4.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.1OSV
  • starcitizenwiki/embedvideo, Packagist3.0.2OSV
  • starcitizenwiki/embedvideo, Packagist3.0.3OSV
  • starcitizenwiki/embedvideo, Packagist3.0.4OSV
  • starcitizenwiki/embedvideo, Packagist3.0.5OSV
  • starcitizenwiki/embedvideo, Packagist3.0.6OSV
  • starcitizenwiki/embedvideo, Packagist3.0.7OSV
  • starcitizenwiki/embedvideo, Packagist3.0.8OSV
  • starcitizenwiki/embedvideo, Packagist3.0.9OSV
  • starcitizenwiki/embedvideo, Packagist3.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.1OSV
  • starcitizenwiki/embedvideo, Packagist3.2.2OSV
  • starcitizenwiki/embedvideo, Packagist3.2.3OSV
  • starcitizenwiki/embedvideo, Packagist3.2.4OSV
  • starcitizenwiki/embedvideo, Packagist3.2.5OSV
  • starcitizenwiki/embedvideo, Packagist3.2.6OSV
  • starcitizenwiki/embedvideo, Packagist3.2.7OSV
  • starcitizenwiki/embedvideo, Packagist3.2.8OSV
  • starcitizenwiki/embedvideo, Packagist3.3.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.1OSV
  • starcitizenwiki/embedvideo, Packagist3.4.2OSV
  • starcitizenwiki/embedvideo, Packagist3.4.3OSV
  • starcitizenwiki/embedvideo, Packagist4.0.0OSV

References 4