Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
### Summary With $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. ### Details The iframe assembled [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L204-L208) adds the url from `getUrl()` as the src without sanitization. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced. ### PoC Using double quotes, the src attribute can be escaped. ``` ``` ### Impact When $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.
GHSA-v65j-hff3-753c
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-v65j-hff3-753c
starcitizenwiki/embedvideo
Source reference: /affected/0/package/name
- Affected versions
- 3.0.0
Source reference:
/affected/0/versions3.0.1Source reference:
/affected/0/versions3.0.2Source reference:
/affected/0/versions3.0.3Source reference:
/affected/0/versions3.0.4Source reference:
/affected/0/versions3.0.5Source reference:
/affected/0/versions3.0.6Source reference:
/affected/0/versions3.0.7Source reference:
/affected/0/versions3.0.8Source reference:
/affected/0/versions3.0.9Source reference:
/affected/0/versions3.1.0Source reference:
/affected/0/versions3.2.0Source reference:
/affected/0/versions3.2.1Source reference:
/affected/0/versions3.2.2Source reference:
/affected/0/versions3.2.3Source reference:
/affected/0/versions3.2.4Source reference:
/affected/0/versions3.2.5Source reference:
/affected/0/versions3.2.6Source reference:
/affected/0/versions3.2.7Source reference:
/affected/0/versions3.2.8Source reference:
/affected/0/versions3.3.0Source reference:
/affected/0/versions3.4.0Source reference:
/affected/0/versions3.4.1Source reference:
/affected/0/versions3.4.2Source reference:
/affected/0/versions3.4.3Source reference:
/affected/0/versions4.0.0Source reference:
/affected/0/versions - Fixed versions
- 4.1.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
]
}
],
"package": {
"name": "starcitizenwiki/embedvideo",
"purl": "pkg:composer/starcitizenwiki/embedvideo",
"ecosystem": "Packagist"
},
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.2.0",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.8",
"3.3.0",
"3.4.0",
"3.4.1",
"3.4.2",
"3.4.3",
"4.0.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-v65j-hff3-753c/GHSA-v65j-hff3-753c.json",
"last_known_affected_version_range": "<= 4.0.0"
}
}
]- Related CVEs
- CVE-2026-57440
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #15311 · Revision 1
- Added to Heist Feed
- Publisher date