# CVE-2026-55690: StarCitizenWiki EmbedVideo Stored XSS in exception text

Source: https://junglewise.ai/threats/cve-2026-55690-starcitizenwiki-embedvideo-stored-xss-in-exception-text  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-55690 · Severity: high · CVSS 7.5 · Published 2026-09-15

The EmbedVideo extension for MediaWiki, which allows users to embed videos from various services into wiki pages, is vulnerable to a security flaw. An attacker can insert malicious code into a page that will execute in the browser of anyone who visits that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information.

Technologies: [starcitizenwiki/embedvideo (Packagist)](https://junglewise.ai/threats/technologies/starcitizenwiki-embedvideo), [StarCitizenWiki EmbedVideo](https://junglewise.ai/threats/technologies/embedvideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [StarCitizenWiki](https://junglewise.ai/threats/vendors/starcitizenwiki).

## Quick answers

**Is CVE-2026-55690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55690 being exploited in the wild.

**How severe is CVE-2026-55690?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** starcitizenwiki/embedvideo (Packagist) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.1.0; StarCitizenWiki EmbedVideo <= 4.0.0.

**Is there a fix for CVE-2026-55690?** Yes. starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55690 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55690?** Check whether you run starcitizenwiki/embedvideo (Packagist) or StarCitizenWiki EmbedVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later

  ```sh
  composer require starcitizenwiki/embedvideo:^4.1.0
  ```


## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the EmbedVideo extension for MediaWiki. The vulnerability is located in the `EmbedServiceFactory#newFromName` method, where an unsanitized service name is injected into an exception message using `sprintf` when an unknown service is requested. This exception message is subsequently rendered as HTML in the wiki interface. An attacker with page editing privileges can exploit this by providing a malicious payload as the service name in an `{{#ev:}}` or `{{#evl:}}` parser function. The payload is stored on the page and executes in the context of any user viewing the page without requiring further interaction. The issue is fixed in version 4.1.0 by using a custom exception class that properly handles HTML escaping.

## Affected products

- StarCitizenWiki EmbedVideo <= 4.0.0

## Identifiers

- CVE-2026-55690
- GHSA-c29q-5xm7-5p62

## Timeline

- 2026-06-15: patched: Fix committed to repository
- 2026-06-19: disclosed: Advisory published via GitHub
- 2026-06-19: advisory: GHSA-c29q-5xm7-5p62 published

## References

- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-c29q-5xm7-5p62](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-c29q-5xm7-5p62)
- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/9215564bf28a0ceb40be550a55ab78efc0accc56](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/9215564bf28a0ceb40be550a55ab78efc0accc56)
- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0)
- [https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-c29q-5xm7-5p62](https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-c29q-5xm7-5p62)

## Related threats

- [MediaWiki EmbedVideo Extension stored XSS via unescaped iframe src](https://junglewise.ai/threats/cve-2026-57440-mediawiki-embedvideo-extension-stored-xss-via-unescaped-iframe)
- [StarCitizenWiki EmbedVideo stored XSS in EmbedHtmlFormatter](https://junglewise.ai/threats/cve-2026-55692-starcitizenwiki-embedvideo-stored-xss-in-embedhtmlformatter)
- [StarCitizenWiki EmbedVideo Stored XSS in EmbedHtmlFormatter](https://junglewise.ai/threats/cve-2026-55691-starcitizenwiki-embedvideo-stored-xss-in-embedhtmlformatter)
- [Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes](https://junglewise.ai/threats/cve-2025-59839-star-citizen-embedvideo-extension-stored-xss-through-wikitext)