CVE-2026-55691 in mediawiki-extensions-EmbedVideo
Summary
by MITRE • 09/15/2026
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page. A user able to edit a wiki page can store JavaScript that executes for visitors who render the affected content. This issue is fixed in version 4.1.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The EmbedVideo extension for MediaWiki serves as a utility for embedding video clips from various third-party sharing services into wiki pages through specific parser functions and tags. A critical security flaw was identified within this extension prior to version 4.1.0, specifically residing in the EmbedHtmlFormatter::toHtml method located in includes/EmbedService/EmbedHtmlFormatter.php. This vulnerability stems from improper input validation and sanitization when processing user-supplied data intended for HTML attribute values. The core technical issue involves the direct passing of a class value to the sprintf function during the construction of an HTML figure element without adequate escaping or encoding mechanisms.
This implementation flaw allows for a classic injection attack vector where special characters, specifically single quotes within the input string, can terminate the surrounding attribute context prematurely. By injecting a closing quote followed by additional attributes or markup elements, an attacker can break out of the intended class attribute scope and inject arbitrary HTML into the rendered page structure. This type of vulnerability is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS). The specific mechanism here represents a reflected or stored XSS depending on how the input was persisted within the wiki content.
The operational impact of this vulnerability is significant for any MediaWiki installation utilizing versions of EmbedVideo earlier than 4.1.0 where user-generated content is permitted. An attacker with edit permissions on a wiki page can embed malicious JavaScript payloads disguised as part of video embedding parameters or class definitions. When other users visit the affected page, their browsers will execute this injected script in the context of the vulnerable website. This execution environment allows for session hijacking, credential theft via keylogging scripts, defacement of the user interface through DOM manipulation, or redirection to malicious external sites designed to exploit browser vulnerabilities.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Client-Side Code Injection and potentially Credential Access if phishing pages are served following initial script execution. The attack chain typically begins with the injection of the payload during page editing, followed by persistence within the wiki database, and culminates in active exploitation when a victim renders the compromised content. This highlights the risk posed to collaborative platforms where multiple users contribute content without rigorous automated sanitization checks on all input fields passed to HTML generation functions.
Mitigation strategies primarily involve upgrading the EmbedVideo extension to version 4.1.0 or later, which addresses this flaw by implementing proper escaping and validation of class attributes before they are processed by sprintf. Administrators should ensure that their MediaWiki instances have applied relevant patches for all extensions regularly. In environments where immediate patching is not feasible due to compatibility constraints, temporary mitigations may include restricting edit permissions to trusted users only or configuring Content Security Policy headers to restrict script execution origins, although these measures do not fully remediate the underlying code defect and should be viewed as compensating controls rather than permanent solutions.