Executive brief
The EmbedVideo extension for MediaWiki allows wiki editors to embed videos on pages. When a specific configuration option is disabled, the extension fails to sanitize user-supplied video identifiers before inserting them into HTML iframe elements, allowing attackers to inject arbitrary JavaScript code that executes for all page visitors without requiring any user interaction.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the EmbedHtmlFormatter component. The vulnerable code directly incorporates URLs returned by getUrl() into iframe src attributes without sanitization. Multiple service-specific regex patterns (archiveorg, wistia, sharepoint) allow double-quote characters to be passed through, enabling escape of the src attribute and injection of HTML event handlers. The flaw requires $wgEmbedVideoRequireConsent to be set to false (non-default configuration). Any user with page-editing privileges can inject malicious parameters via embedvideo tags; the injected JavaScript executes automatically with autofocus attributes and affects all visitors viewing the compromised wiki page. The vulnerability is patched in version 4.1.0.
Affected products
- StarCitizenWiki EmbedVideo <= 4.0.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: Version 4.1.0 released
- 2026-09-25: advisory