Most recent entries from all

EUVD-2026-369648

2026-10-07T07:16:21.974886+00:00

EUVD-2026-369648

fkie_cve-2026-55691

2026-10-07T07:16:21.974930+00:00

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page. A user able to edit a wiki page can store JavaScript that executes for visitors who render the affected content. This issue is fixed in version 4.1.0.

GHSA-7h5p-637f-jfr7 — StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

2026-10-07T07:16:21.974970+00:00

Affected: Packagist: starcitizenwiki/embedvideo

### Summary The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

### Details The template [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L138) adds a figure with a class that is substituted in. This value is provided to sprintf [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L156), an unescaped version of the class supplied by the user.

``` $template = <<

%s%s%s

%s HTML; ```

### PoC Note the double quote immediately following the single quote to escape the class attribute in the template: ``` dQw4w9WgXcQ ```

### Impact Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.