Executive brief
The EmbedVideo extension for MediaWiki, which allows users to embed video content on wiki pages, contains a security flaw in how it handles user-provided styling classes. An attacker can use this flaw to inject malicious scripts into a page, which would then execute in the browsers of other users viewing that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information like login tokens.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the EmbedVideo extension (starcitizenwiki/embedvideo) for MediaWiki. The root cause is located in `EmbedHtmlFormatter.php`, where user-supplied 'class' values are passed directly into an HTML template via `sprintf` without proper escaping or neutralization. An attacker can provide a specially crafted class string containing a double quote to break out of the HTML attribute and inject arbitrary JavaScript events (e.g., `onmouseover`). This allows for the execution of arbitrary code in the context of any user viewing the affected page. The vulnerability is addressed in version 4.1.0 by migrating to the Mustache template engine for secure HTML generation.
Affected products
- StarCitizenWiki EmbedVideo <= 4.0.0
Timeline
- 2026-06-02: other: Initial fix authored in source code
- 2026-06-19: patched: Version 4.1.0 released
- 2026-06-19: advisory: GitHub Advisory published
References
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0
- https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-7h5p-637f-jfr7