cyfenced.com →

[ CVE-2026-57440 · Published 24 Sep 2026 ]

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

CVSS 7.5 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.

[ Fixes ]Fixes and patches

  • starcitizenwiki/embedvideo 4.1.0Fixed version · GitHub Advisories · composer package starcitizenwiki/embedvideo: upgrade to 4.1.0 or later (affected <= 4.0.0)

[ Advisories ]Government CERT advisories

[ Packages ]Affected open-source packages

  • starcitizenwiki/embedvideo composerAffected <= 4.0.0 · fixed in 4.1.0 · GHSA-v65j-hff3-753c

[ References ]References