The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php interpolates an attacker-controlled unknown service name into exception text, and includes/EmbedVideo.php returns that text as HTML through the isHtml output path without neutralization. Both the #ev parser function and the evl parser form can reach this error path. A user able to edit a wiki page can inject stored HTML or JavaScript into the error output, causing code to execute in the wiki origin for visitors who render the page. This issue is fixed in version 4.1.0.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| StarCitizenWiki | mediawiki-extensions-EmbedVideo | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-c29q-5xm7-5p62 | StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 15 Sep 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php interpolates an attacker-controlled unknown service name into exception text, and includes/EmbedVideo.php returns that text as HTML through the isHtml output path without neutralization. Both the #ev parser function and the evl parser form can reach this error path. A user able to edit a wiki page can inject stored HTML or JavaScript into the error output, causing code to execute in the wiki origin for visitors who render the page. This issue is fixed in version 4.1.0. | |
| Title | EmbedVideo Extension: Stored XSS via unsanitized service name in exception text | |
| Weaknesses | CWE-79 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-09-15T16:34:08.668Z
Reserved: 2026-06-17T00:13:10.650Z
Link: CVE-2026-55690
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses