{"id":"CVE-2026-55692","aliases":["EUVD-2026-78829","GHSA-5c7p-g73q-rpg5"],"status":"published","title":"EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00492,"percentile":0.42546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2026-06-19T21:41:57Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Packagist","package":"starcitizenwiki/embedvideo","fixed_in":["4.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizenwiki/embedvideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"},{"fixed":"4.1.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizenwiki/embedvideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.3.0","3.4.0","3.4.1","3.4.2","3.4.3","4.0.0"]}],"products":[{"vendor":"starcitizenwiki","product":"mediawiki-extensions-embedvideo"}],"references":[{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-5c7p-g73q-rpg5","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-5c7p-g73q-rpg5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55692.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55692","tags":["advisory"]},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55692","title":"EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.","status":"published","published":"2026-09-15T16:33:04.876Z","modified":"2026-09-15T19:03:49.954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-78829","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.","status":"published","published":"2026-09-15T16:33:04Z","modified":"2026-09-15T19:03:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:17.333425Z"}],"ghsa":[{"id":"GHSA-5c7p-g73q-rpg5","title":"StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","description":"### Summary\nWith $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data attribute`data-mw-iframeconfig`. When given a malformed url or id, the data-mw-iframeconfig attribute can be escaped via single quotes, allowing for html/javascript injection.\n\n### Details\nThe sprintf [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L115-L120) adds the iframe config encoded as JSON [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/AbstractEmbedService.php#L518). When given a malicious url or id with a single quote, the `$this-\u003egetUrl()` call returns an unescaped payload that terminates the data-mw-iframeconfig attribute and allows for injecting attributes, including handlers, into the figure element. The id regex for the `archiveorg` service and the url regexes for the `wistia` and `sharepoint` services allow for single quotes to be introduced.\n\n### PoC\nA couple of examples across services\n```\nInput:\n\u003cembedvideo service=\"archiveorg\" id=\"x' onmouseover='alert(document.domain)' data-x='\"\u003e\u003c/embedvideo\u003e\n\nRenders:\n\u003cfigure class=\"embedvideo\" data-service=\"archiveorg\" data-mw-iframeconfig=\"{\u0026quot;src\u0026quot;:\u0026quot;//archive.org/embed/x\" onmouseover=\"alert(document.domain)\" data-x=\"?autoplay=1\u0026quot;}\" style=\"width:640px\"\u003e\n\u003cdiv class=\"embedvideo-wrapper\" style=\"height:493px\"\u003e\u003cdiv class=\"embedvideo-consent\" data-show-privacy-notice=\"1\"\u003e\n...\n\u003c/div\u003e\n\u003c/figure\u003e\n```\n\n```\nInput:\n{{#ev:wistia|https://wistia.com/medias/x'onmouseover='alert(document.domain)'}}\n\nRenders:\n\u003cfigure class=\"embedvideo\" data-service=\"wistia\" data-mw-iframeconfig=\"{\u0026quot;src\u0026quot;:\u0026quot;//fast.wistia.net/embed/iframe/x\" onmouseover=\"alert(document.domain)\" ?autoplay=\"1\u0026quot;}'\" style=\"width:640px\"\u003e\n\u003cdiv class=\"embedvideo-wrapper\" style=\"height:360px\"\u003e\u003cdiv class=\"embedvideo-consent\" data-show-privacy-notice=\"1\"\u003e\n...\n\u003c/div\u003e\n\u003c/figure\u003e\n```\n\n```\n{{#ev:sharepoint|https://a.sharepoint.com/sites/x'onmouseover='alert(document.domain)'.aspx}}\n```\n\n### Impact\nUnder the default $wgEmbedVideoRequireConsent = true configuration, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.","status":"published","published":"2026-06-19T21:41:57Z","modified":"2026-10-13T20:50:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-55692","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.","status":"published","published":"2026-09-15T17:17:22.33Z","modified":"2026-09-30T17:51:56.193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-55692","title":"EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","description":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.","status":"published","published":"2026-09-15T16:33:04.876Z","modified":"2026-10-28T02:30:53.714761906Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-5c7p-g73q-rpg5","title":"StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","description":"### Summary\nWith $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data attribute`data-mw-iframeconfig`. When given a malformed url or id, the data-mw-iframeconfig attribute can be escaped via single quotes, allowing for html/javascript injection.\n\n### Details\nThe sprintf [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L115-L120) adds the iframe config encoded as JSON [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/AbstractEmbedService.php#L518). When given a malicious url or id with a single quote, the `$this-\u003egetUrl()` call returns an unescaped payload that terminates the data-mw-iframeconfig attribute and allows for injecting attributes, including handlers, into the figure element. The id regex for the `archiveorg` service and the url regexes for the `wistia` and `sharepoint` services allow for single quotes to be introduced.\n\n### PoC\nA couple of examples across services\n```\nInput:\n\u003cembedvideo service=\"archiveorg\" id=\"x' onmouseover='alert(document.domain)' data-x='\"\u003e\u003c/embedvideo\u003e\n\nRenders:\n\u003cfigure class=\"embedvideo\" data-service=\"archiveorg\" data-mw-iframeconfig=\"{\u0026quot;src\u0026quot;:\u0026quot;//archive.org/embed/x\" onmouseover=\"alert(document.domain)\" data-x=\"?autoplay=1\u0026quot;}\" style=\"width:640px\"\u003e\n\u003cdiv class=\"embedvideo-wrapper\" style=\"height:493px\"\u003e\u003cdiv class=\"embedvideo-consent\" data-show-privacy-notice=\"1\"\u003e\n...\n\u003c/div\u003e\n\u003c/figure\u003e\n```\n\n```\nInput:\n{{#ev:wistia|https://wistia.com/medias/x'onmouseover='alert(document.domain)'}}\n\nRenders:\n\u003cfigure class=\"embedvideo\" data-service=\"wistia\" data-mw-iframeconfig=\"{\u0026quot;src\u0026quot;:\u0026quot;//fast.wistia.net/embed/iframe/x\" onmouseover=\"alert(document.domain)\" ?autoplay=\"1\u0026quot;}'\" style=\"width:640px\"\u003e\n\u003cdiv class=\"embedvideo-wrapper\" style=\"height:360px\"\u003e\u003cdiv class=\"embedvideo-consent\" data-show-privacy-notice=\"1\"\u003e\n...\n\u003c/div\u003e\n\u003c/figure\u003e\n```\n\n```\n{{#ev:sharepoint|https://a.sharepoint.com/sites/x'onmouseover='alert(document.domain)'.aspx}}\n```\n\n### Impact\nUnder the default $wgEmbedVideoRequireConsent = true configuration, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.","status":"published","published":"2026-06-19T21:41:57Z","modified":"2026-09-10T03:50:48.274310428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}