Read the docs
TI-2026-41377 Aliases CVE-2026-57440GHSA-v65j-hff3-753c

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Priority HIGH 72CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed mediawiki-extensions-EmbedVideo (StarCitizenWiki): 4.1.0starcitizenwiki/embedvideo (Packagist): 4.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StarCitizenWikimediawiki-extensions-EmbedVideobefore 4.1.04.1.0Patch availableCNA
—starcitizenwiki/embedvideo (Packagist)before 4.1.04.1.0Patch availableGHSA-v65j-hff3-753c
  • mediawiki-extensions-EmbedVideo VendorStarCitizenWiki Affected before 4.1.0 Fixed in 4.1.0 Patch available CNA
  • starcitizenwiki/embedvideo (Packagist) Vendor— Affected before 4.1.0 Fixed in 4.1.0 Patch available GHSA-v65j-hff3-753c

Remediation

  • Fix · CNA mediawiki-extensions-EmbedVideo (StarCitizenWiki) Fixed in 4.1.0
  • Fix · GHSA-v65j-hff3-753c starcitizenwiki/embedvideo (Packagist) Fixed in 4.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57440
  2. 2026-10-03 Alias added: GHSA-v65j-hff3-753c

References

Advisory 1

Other 3

  • TI-2026-40206 EmbedVideo Extension : Stored XSS via unsanitized class passed to template CVSS 3.1HIGH 8.6
  • TI-2026-40207 EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled CVSS 3.1HIGH 7.5
  • TI-2026-40205 EmbedVideo Extension: Stored XSS via unsanitized service name in exception text CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences