{"id":"CVE-2025-59839","aliases":["EUVD-2025-31038","GHSA-4j5h-mvj3-m48v"],"status":"published","title":"Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0031,"percentile":0.24042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-09-24T20:11:17Z","modified":"2026-10-28T02:31:09Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizenwiki/embedvideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizenwiki/embedvideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.3.0","3.4.0","3.4.1","3.4.2","3.4.3","4.0.0"]}],"products":[{"vendor":"star-citizen","product":"embedvideo"},{"vendor":"starcitizenwiki","product":"mediawiki-extensions-embedvideo"}],"references":[{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59839","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4j5h-mvj3-m48v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59839.json","tags":["advisory"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59839","title":"Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.","status":"published","published":"2025-09-25T13:56:13.804Z","modified":"2025-09-25T14:19:53.153Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-31038","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.","status":"published","published":"2025-09-25T13:56:13Z","modified":"2025-09-25T14:19:53Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:31:40.063213Z"}],"ghsa":[{"id":"GHSA-4j5h-mvj3-m48v","title":"Star Citizen  EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","description":"### Summary\nThe EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext.\n\n### Details\n\nThe attributes of an iframe are populated with the value of an unreserved data attribute (`data-iframeconfig`) that can be set via wikitext:\nhttps://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20\nSimilar code is also present here:\nhttps://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155\n\nIt is possible to execute JS through attributes like `onload` or `onmouseenter`.\n\n### PoC\n\n1. Create a page with the following contents:\n```html\n\u003cdiv class=\"embedvideo-evl\" data-iframeconfig='{\"onload\": \"alert(1)\"}'\u003eClick me!\u003c/div\u003e\n\u003cevlplayer\u003e\u003c/evlplayer\u003e\n```\n2. Click on the \"Click me!\" text\n3. Click on the \"Load video\" button below\n\u003cimg width=\"855\" height=\"404\" alt=\"image\" src=\"https://github.com/user-attachments/assets/afb3839a-012c-4e90-a208-a6137b704ccd\" /\u003e\n\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.","status":"published","published":"2025-09-24T20:11:17Z","modified":"2025-09-26T16:30:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:58.965005Z"}],"nvd":[{"id":"CVE-2025-59839","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.","status":"published","published":"2025-09-25T14:15:46.57Z","modified":"2026-10-11T20:10:00.2Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"CVE-2025-59839","title":"Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.","status":"published","published":"2025-09-25T13:56:13.804Z","modified":"2026-10-28T02:31:09.280406993Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"GHSA-4j5h-mvj3-m48v","title":"Star Citizen  EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","description":"### Summary\nThe EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext.\n\n### Details\n\nThe attributes of an iframe are populated with the value of an unreserved data attribute (`data-iframeconfig`) that can be set via wikitext:\nhttps://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20\nSimilar code is also present here:\nhttps://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155\n\nIt is possible to execute JS through attributes like `onload` or `onmouseenter`.\n\n### PoC\n\n1. Create a page with the following contents:\n```html\n\u003cdiv class=\"embedvideo-evl\" data-iframeconfig='{\"onload\": \"alert(1)\"}'\u003eClick me!\u003c/div\u003e\n\u003cevlplayer\u003e\u003c/evlplayer\u003e\n```\n2. Click on the \"Click me!\" text\n3. Click on the \"Load video\" button below\n\u003cimg width=\"855\" height=\"404\" alt=\"image\" src=\"https://github.com/user-attachments/assets/afb3839a-012c-4e90-a208-a6137b704ccd\" /\u003e\n\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.","status":"published","published":"2025-09-24T20:11:17Z","modified":"2026-09-10T03:50:27.926243875Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}