Is CVE-2026-55690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55690 being exploited in the wild.

How severe is CVE-2026-55690?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

starcitizenwiki/embedvideo (Packagist) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.1.0; StarCitizenWiki EmbedVideo <= 4.0.0.

Is there a fix for CVE-2026-55690?

Yes. starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55690 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55690?

Check whether you run starcitizenwiki/embedvideo (Packagist) or StarCitizenWiki EmbedVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55690: StarCitizenWiki EmbedVideo Stored XSS in exception text

Q: Is there a fix for CVE-2026-55690?

Yes. starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55690 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55690?

Check whether you run starcitizenwiki/embedvideo (Packagist) or StarCitizenWiki EmbedVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55690 · Severity: high · CVSS 7.5 · Published 2026-09-15

The EmbedVideo extension for MediaWiki, which allows users to embed videos from various services into wiki pages, is vulnerable to a security flaw. An attacker can insert malicious code into a page that will execute in the browser of anyone who visits that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information.

Technologies: starcitizenwiki/embedvideo (Packagist), StarCitizenWiki EmbedVideo. Vendors: Packagist, StarCitizenWiki.

Quick answers

Is CVE-2026-55690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55690 being exploited in the wild.
How severe is CVE-2026-55690?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: starcitizenwiki/embedvideo (Packagist) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.1.0; StarCitizenWiki EmbedVideo <= 4.0.0.
Is there a fix for CVE-2026-55690?: Yes. starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55690 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55690?: Check whether you run starcitizenwiki/embedvideo (Packagist) or StarCitizenWiki EmbedVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later
```
composer require starcitizenwiki/embedvideo:^4.1.0
```

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the EmbedVideo extension for MediaWiki. The vulnerability is located in the `EmbedServiceFactory#newFromName` method, where an unsanitized service name is injected into an exception message using `sprintf` when an unknown service is requested. This exception message is subsequently rendered as HTML in the wiki interface. An attacker with page editing privileges can exploit this by providing a malicious payload as the service name in an `{{#ev:}}` or `{{#evl:}}` parser function. The payload is stored on the page and executes in the context of any user viewing the page without requiring further interaction. The issue is fixed in version 4.1.0 by using a custom exception class that properly handles HTML escaping.

Affected products

StarCitizenWiki EmbedVideo <= 4.0.0

Identifiers

CVE-2026-55690
GHSA-c29q-5xm7-5p62

Timeline

2026-06-15: patched: Fix committed to repository
2026-06-19: disclosed: Advisory published via GitHub
2026-06-19: advisory: GHSA-c29q-5xm7-5p62 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.