CVE-2026-57440: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MediaWiki EmbedVideo Extensionto a version that resolves this vulnerability.Fixed in 4.1.0
Event History
Frequently Asked Questions
Is the default configuration affected?
No. The issue requires $wgEmbedVideoRequireConsent to be disabled, which is not the default configuration.
What does an attacker need to exploit this?
An attacker needs to be able to supply a malformed video URL or ID to the extension’s embedding functionality. The affected input can break out of the iframe src attribute using double quotes and inject HTML or JavaScript.
Which versions should be remediated?
Versions prior to 4.1.0 are affected when consent is disabled. Upgrade to version 4.1.0, which contains the patch.
What can be done if an immediate upgrade is not possible?
Enable $wgEmbedVideoRequireConsent and avoid accepting malformed or untrusted video URLs and IDs in EmbedVideo tags until the extension can be updated.