Executive brief
The EmbedVideo extension for MediaWiki, which allows users to embed videos from various services into wiki pages, contains a security flaw in its consent management feature. When the video consent requirement is enabled, an attacker with page-editing permissions can craft a malicious video link that injects unauthorized code into the page. This code automatically runs in the browser of any visitor who views the page, potentially allowing the attacker to steal sensitive information or perform actions on behalf of other users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the StarCitizenWiki EmbedVideo extension for MediaWiki when '$wgEmbedVideoRequireConsent' is enabled. The vulnerability is located in 'EmbedHtmlFormatter.php', where video configurations are JSON-encoded and placed into the 'data-mw-iframeconfig' attribute using 'sprintf' without adequate escaping. Specifically, the regex patterns for services like 'archiveorg', 'wistia', and 'sharepoint' fail to filter single quotes, allowing an attacker to terminate the attribute and inject arbitrary HTML event handlers (e.g., 'onmouseover' or 'autofocus'). This results in stored XSS that executes in the wiki's origin for every visitor. The issue is fixed in version 4.1.0 by migrating to mustache templates for proper output escaping.
Affected products
- StarCitizenWiki EmbedVideo <= 4.0.0
Timeline
- 2026-06-19: advisory: GitHub Advisory GHSA-5c7p-g73q-rpg5 published
- 2026-06-19: patched: Version 4.1.0 released
References
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-5c7p-g73q-rpg5
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0
- https://api.github.com/repos/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security-advisories/GHSA-5c7p-g73q-rpg5