All vulnerabilities
CVE-2026-57440GHSA-v65j-hff3-753c

starcitizenwiki/embedvideo: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

StarCitizenWiki starcitizenwiki/embedvideocomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published24 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

  • 4.1.0starcitizenwiki/embedvideo, composerGitHubcomposer require "starcitizenwiki/embedvideo:^4.1.0"
  • 4.1.0starcitizenwiki/embedvideo, PackagistOSVcomposer require "starcitizenwiki/embedvideo:^4.1.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

With $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection.

Details

The iframe assembled here adds the url from getUrl() as the src without sanitization. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced.

PoC

Using double quotes, the src attribute can be escaped.

<embedvideo service="archiveorg" id='a" onmouseover="alert(document.domain)" data-x="'></embedvideo>

Impact

When $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.

Text from GitHub Advisory Database

Affected versions 29

  • starcitizenwiki/embedvideo, composer<= 4.0.0GitHub
  • mediawiki-extensions-EmbedVideoaffected: < 4.1.0CVE List
  • starcitizenwiki/embedvideo, Packagistfrom first release, fixed in 4.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.0OSV
  • starcitizenwiki/embedvideo, Packagist3.0.1OSV
  • starcitizenwiki/embedvideo, Packagist3.0.2OSV
  • starcitizenwiki/embedvideo, Packagist3.0.3OSV
  • starcitizenwiki/embedvideo, Packagist3.0.4OSV
  • starcitizenwiki/embedvideo, Packagist3.0.5OSV
  • starcitizenwiki/embedvideo, Packagist3.0.6OSV
  • starcitizenwiki/embedvideo, Packagist3.0.7OSV
  • starcitizenwiki/embedvideo, Packagist3.0.8OSV
  • starcitizenwiki/embedvideo, Packagist3.0.9OSV
  • starcitizenwiki/embedvideo, Packagist3.1.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.0OSV
  • starcitizenwiki/embedvideo, Packagist3.2.1OSV
  • starcitizenwiki/embedvideo, Packagist3.2.2OSV
  • starcitizenwiki/embedvideo, Packagist3.2.3OSV
  • starcitizenwiki/embedvideo, Packagist3.2.4OSV
  • starcitizenwiki/embedvideo, Packagist3.2.5OSV
  • starcitizenwiki/embedvideo, Packagist3.2.6OSV
  • starcitizenwiki/embedvideo, Packagist3.2.7OSV
  • starcitizenwiki/embedvideo, Packagist3.2.8OSV
  • starcitizenwiki/embedvideo, Packagist3.3.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.0OSV
  • starcitizenwiki/embedvideo, Packagist3.4.1OSV
  • starcitizenwiki/embedvideo, Packagist3.4.2OSV
  • starcitizenwiki/embedvideo, Packagist3.4.3OSV
  • starcitizenwiki/embedvideo, Packagist4.0.0OSV

References 4