# CVE-2026-55691: StarCitizenWiki EmbedVideo Stored XSS in EmbedHtmlFormatter

Source: https://junglewise.ai/threats/cve-2026-55691-starcitizenwiki-embedvideo-stored-xss-in-embedhtmlformatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-55691 · Severity: high · CVSS 8.6 · Published 2026-09-15

The EmbedVideo extension for MediaWiki, which allows users to embed video content on wiki pages, contains a security flaw in how it handles user-provided styling classes. An attacker can use this flaw to inject malicious scripts into a page, which would then execute in the browsers of other users viewing that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information like login tokens.

Technologies: [starcitizenwiki/embedvideo (Packagist)](https://junglewise.ai/threats/technologies/starcitizenwiki-embedvideo), [StarCitizenWiki EmbedVideo](https://junglewise.ai/threats/technologies/embedvideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [StarCitizenWiki](https://junglewise.ai/threats/vendors/starcitizenwiki).

## Quick answers

**Is CVE-2026-55691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55691 being exploited in the wild.

**How severe is CVE-2026-55691?** High severity, with a CVSS score of 8.6, published 15 September 2026.

**Which products and versions are affected?** starcitizenwiki/embedvideo (Packagist) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.1.0; StarCitizenWiki EmbedVideo <= 4.0.0.

**Is there a fix for CVE-2026-55691?** Yes. starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55691 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55691?** Check whether you run starcitizenwiki/embedvideo (Packagist) or StarCitizenWiki EmbedVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- starcitizenwiki/embedvideo (Packagist): upgrade to 4.1.0 or later

  ```sh
  composer require starcitizenwiki/embedvideo:^4.1.0
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the EmbedVideo extension (starcitizenwiki/embedvideo) for MediaWiki. The root cause is located in `EmbedHtmlFormatter.php`, where user-supplied 'class' values are passed directly into an HTML template via `sprintf` without proper escaping or neutralization. An attacker can provide a specially crafted class string containing a double quote to break out of the HTML attribute and inject arbitrary JavaScript events (e.g., `onmouseover`). This allows for the execution of arbitrary code in the context of any user viewing the affected page. The vulnerability is addressed in version 4.1.0 by migrating to the Mustache template engine for secure HTML generation.

## Affected products

- StarCitizenWiki EmbedVideo <= 4.0.0

## Identifiers

- CVE-2026-55691
- GHSA-7h5p-637f-jfr7

## Timeline

- 2026-06-02: other: Initial fix authored in source code
- 2026-06-19: patched: Version 4.1.0 released
- 2026-06-19: advisory: GitHub Advisory published

## References

- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7)
- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84)
- [https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0)
- [https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-7h5p-637f-jfr7](https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-7h5p-637f-jfr7)

## Related threats

- [MediaWiki EmbedVideo Extension stored XSS via unescaped iframe src](https://junglewise.ai/threats/cve-2026-57440-mediawiki-embedvideo-extension-stored-xss-via-unescaped-iframe)
- [StarCitizenWiki EmbedVideo stored XSS in EmbedHtmlFormatter](https://junglewise.ai/threats/cve-2026-55692-starcitizenwiki-embedvideo-stored-xss-in-embedhtmlformatter)
- [StarCitizenWiki EmbedVideo Stored XSS in exception text](https://junglewise.ai/threats/cve-2026-55690-starcitizenwiki-embedvideo-stored-xss-in-exception-text)
- [Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes](https://junglewise.ai/threats/cve-2025-59839-star-citizen-embedvideo-extension-stored-xss-through-wikitext)