Listen to this Post
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. The iframe assembled here adds the url from getUrl() as the src without sanitization. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced. Using double quotes, the src attribute can be escaped. When $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page. Version 4.1.0 contains a patch. This vulnerability is identified as CVE-2026-57440 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The CVSS 3.1 base score is 7.5 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack can be initiated remotely with no authentication required. The exploitability is told to be easy. The affected product is StarCitizenWiki mediawiki-extensions-EmbedVideo version less than 4.1.0. The vulnerability was published on 2026-09-24. Technical details are known. Upgrading to version 4.1.0 eliminates this vulnerability. The specific vulnerable code path involves includes/EmbedService/EmbedHtmlFormatter.php placing JSON returned through includes/EmbedService/AbstractEmbedService.php into the iframe src attribute without safely escaping double quotes. The PoC uses the embedvideo parser tag with a crafted archiveorg id containing double quotes to break out of the src attribute and inject an event handler. This allows stored XSS that executes for every visitor to the page. The vulnerability requires that the wiki administrator has disabled the consent requirement, which is not the default configuration.
DailyCVE Form:
Platform: MediaWiki EmbedVideo
Version: < 4.1.0
Vulnerability: Stored XSS
Severity: High 7.5
date: 2026-09-24
Prediction: Version 4.1.0 released
What Undercode Say:
grep -r “wgEmbedVideoRequireConsent” includes/
curl -s “http://wiki/index.php?=Test&action=raw” | grep “iframe”
echo ‘‘ | tee payload.txt
python3 -c “import requests; requests.post(‘http://wiki/api.php’, data={‘action’:’edit’,”:’XSS’,’text’:open(‘payload.txt’).read(),’token’:’+\’})”
Exploit: (Educational Purposes!)
curl -X POST “http://target-wiki/api.php” -d “action=edit&=PoC&text=%3Cembedvideo%20service%3D%22archiveorg%22%20id%3D%27a%22%20onmouseover%3D%22alert(document.domain)%22%20data-x%3D%27%27%3E%3C%2Fembedvideo%3E&token=YOUR_CSRF_TOKEN”
Protection: from this CVE
Set $wgEmbedVideoRequireConsent = true
Update to version 4.1.0
Sanitize iframe src attribute
Escape double quotes
Impact:
Arbitrary JavaScript execution in wiki origin for every visitor. Stored XSS affecting all users viewing the page. No interaction required. Session hijacking and credential theft possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
