CVE-2026-57440: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Summary With $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection.
Details The iframe assembled here adds the url from getUrl() as the src without sanitization. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced.
PoC Using double quotes, the src attribute can be escaped. <embedvideo service="archiveorg" id='a" onmouseover="alert(document.domain)" data-x="'></embedvideo>
Impact When $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.
Other sources
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/starcitizenwiki/embedvideoto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
MediaWiki EmbedVideo Extensionto a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Enable $wgEmbedVideoRequireConsent; the vulnerable behavior occurs when this setting is disabled.
MediaWiki EmbedVideo Extension $wgEmbedVideoRequireConsent = true
Event History
Frequently Asked Questions
Is the default configuration affected?
No. The issue requires $wgEmbedVideoRequireConsent to be disabled, which is not the default configuration.
What does an attacker need to exploit this?
An attacker needs to be able to supply a malformed video URL or ID to the extension’s embedding functionality. The affected input can break out of the iframe src attribute using double quotes and inject HTML or JavaScript.
Which versions should be remediated?
Versions prior to 4.1.0 are affected when consent is disabled. Upgrade to version 4.1.0, which contains the patch.
What can be done if an immediate upgrade is not possible?
Enable $wgEmbedVideoRequireConsent and avoid accepting malformed or untrusted video URLs and IDs in EmbedVideo tags until the extension can be updated.