Junglewise Threat Intelligence

CVE-2026-55690: The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips

CVE-2026-55690 · Severity: high · CVSS 7.5 · Published 2026-09-15

Executive brief

The EmbedVideo extension for MediaWiki, which allows users to embed videos from various services into wiki pages, is vulnerable to a security flaw. An attacker can insert malicious code into a page that will execute in the browser of anyone who visits that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the EmbedVideo extension for MediaWiki. The vulnerability is located in the `EmbedServiceFactory#newFromName` method, where an unsanitized service name is injected into an exception message using `sprintf` when an unknown service is requested. This exception message is subsequently rendered as HTML in the wiki interface. An attacker with page editing privileges can exploit this by providing a malicious payload as the service name in an `{{#ev:}}` or `{{#evl:}}` parser function. The payload is stored on the page and executes in the context of any user viewing the page without requiring further interaction. The issue is fixed in version 4.1.0 by using a custom exception class that properly handles HTML escaping.

Affected products

  • StarCitizenWiki EmbedVideo <= 4.0.0

Timeline

  • 2026-06-15: patched: Fix committed to repository
  • 2026-06-19: disclosed: Advisory published via GitHub
  • 2026-06-19: advisory: GHSA-c29q-5xm7-5p62 published

References

Related threats