CVE-2026-55690: MediaWiki EmbedVideo Extension XSS Vulnerability

CVE-2026-55690 Overview

CVE-2026-55690 is a stored cross-site scripting (XSS) vulnerability in the EmbedVideo extension for MediaWiki. The extension adds a #ev parser function and additional parser tags for embedding video clips from third-party sharing services. Versions prior to 4.1.0 interpolate an attacker-controlled service name into exception text and return that text as HTML without neutralization. Any user with wiki edit permissions can inject persistent HTML or JavaScript that executes in the wiki origin when other visitors render the page. The issue is fixed in version 4.1.0 and is tracked as [CWE-79].

Critical Impact
Authenticated editors can persist arbitrary JavaScript that runs in the wiki origin for every viewer, enabling session theft, privilege abuse, and account takeover of administrators.

Affected Products

MediaWiki EmbedVideo extension versions prior to 4.1.0
includes/EmbedService/EmbedServiceFactory.php (newFromName method)
includes/EmbedVideo.php (isHtml output path)

Discovery Timeline

2026-09-15 - CVE-2026-55690 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55690

Vulnerability Analysis

The flaw is a stored XSS reachable through both the #ev parser function and the evl parser form. When a wiki editor supplies an unknown service name to either entry point, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php throws an exception whose message embeds the raw attacker-controlled string. includes/EmbedVideo.php then propagates that exception text through the isHtml output path, which marks the content as trusted HTML. The result is that malicious markup or <script> payloads are stored in the page source and rendered to every subsequent visitor.

Root Cause

The root cause is missing output neutralization on an error branch. The factory method assumes the exception path is developer-facing and does not escape the interpolated service name. The parser output layer treats the exception message as pre-sanitized HTML rather than untrusted text. This mismatch between producer and consumer expectations is a classic Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Attack Vector

Exploitation requires only the ability to edit a wiki page that permits the EmbedVideo tags. An attacker crafts an #ev or evl invocation using a bogus service name containing HTML or JavaScript. When any user later renders the page, the payload executes in the wiki origin, enabling cookie theft, CSRF against privileged endpoints, or defacement.

php

// Patch scope in includes/EmbedService/EmbedServiceFactory.php
 namespace MediaWiki\Extension\EmbedVideo\EmbedService;

-use InvalidArgumentException;
 use MediaWiki\Extension\EmbedVideo\EmbedService\AppleMusic\AppleMusicAlbum;
 use MediaWiki\Extension\EmbedVideo\EmbedService\AppleMusic\AppleMusicArtist;
 use MediaWiki\Extension\EmbedVideo\EmbedService\AppleMusic\AppleMusicPlaylist;

// Patch scope in includes/EmbedService/AbstractEmbedService.php
 namespace MediaWiki\Extension\EmbedVideo\EmbedService;

-use InvalidArgumentException;
 use JsonException;
 use MediaTransformOutput;
 use MediaWiki\Config\Config;
+use MediaWiki\Extension\EmbedVideo\EmbedVideoException;
 use MediaWiki\MediaWikiServices;
 use MediaWiki\Title\Title;
 use RuntimeException;
// Source: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/9215564bf28a0ceb40be550a55ab78efc0accc56

The fix replaces the generic InvalidArgumentException with a dedicated EmbedVideoException type so the parser can distinguish user-controlled errors and route them through a neutralized rendering path instead of the isHtml channel.

Detection Methods for CVE-2026-55690

Indicators of Compromise

Wiki page revisions containing #ev or evl invocations whose first argument (service name) includes <, >, ", ', or script tokens.
Rendered pages emitting <script> or event-handler attributes inside EmbedVideo error output blocks.
Unexpected outbound requests from viewer browsers to attacker-controlled domains sourced from wiki pages.

Detection Strategies

Query the MediaWiki revision and text tables for stored payloads matching the pattern {{#ev:[^|}]*[<>"'] and the equivalent evl tag form.
Enable and monitor Content Security Policy (CSP) violation reports for the wiki origin to surface unexpected inline script execution.
Review parser cache entries for HTML fragments that combine EmbedVideo error strings with active markup.

Monitoring Recommendations

Alert on EmbedVideo extension version strings below 4.1.0 during asset inventory scans.
Log and review page edits that add or modify EmbedVideo parser calls, particularly from newly registered accounts.
Track anomalous authenticated session activity, such as privilege changes or API token creation, following exposure to affected pages.

How to Mitigate CVE-2026-55690

Immediate Actions Required

Upgrade the EmbedVideo extension to version 4.1.0 or later on all MediaWiki instances.
Audit wiki content for existing malicious #ev and evl invocations and revert affected revisions.
Rotate administrator session cookies and API tokens for any wiki where exposure is suspected.

Patch Information

The maintainers released the fix in GitHub Release v4.1.0. The corrective change is documented in GitHub Commit 9215564 and the GHSA-c29q-5xm7-5p62 advisory. The patch introduces a dedicated EmbedVideoException and removes the interpolation path that reached the isHtml output.

Workarounds

Disable the EmbedVideo extension in LocalSettings.php until the upgrade is applied.
Restrict page editing to trusted user groups and require review before publishing edits that use EmbedVideo tags.
Deploy a strict Content Security Policy that blocks inline scripts from the wiki origin as a defense-in-depth measure.

bash

# Configuration example: disable extension until patched
# In LocalSettings.php, comment out or remove the load line:
# wfLoadExtension( 'EmbedVideo' );

# Then verify the installed version after upgrade:
php maintenance/showJobs.php --list | grep -i embedvideo
grep -R "'version'" extensions/EmbedVideo/extension.json