CVE-2026-55691: MediaWiki EmbedVideo Extension XSS Vulnerability

CVE-2026-55691 Overview

CVE-2026-55691 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the EmbedVideo extension for MediaWiki. The extension adds a #ev parser function and various parser tags for embedding video clips from third-party sharing services. In versions prior to 4.1.0, the EmbedHtmlFormatter::toHtml method in includes/EmbedService/EmbedHtmlFormatter.php passes a user-supplied class value directly to sprintf while constructing a <figure> element. Any user with edit rights on a wiki page can inject arbitrary HTML attributes or JavaScript that executes in the browsers of subsequent visitors.

Critical Impact
Authenticated wiki editors can store JavaScript that runs in the context of every reader who renders the affected page, enabling session theft, credential harvesting, and account takeover of privileged users.

Affected Products

EmbedVideo extension for MediaWiki, all versions prior to 4.1.0
MediaWiki installations using the StarCitizenWiki maintained fork of the extension
Wiki deployments that permit page editing by non-administrative users

Discovery Timeline

2026-09-15 - CVE-2026-55691 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-55691

Vulnerability Analysis

The flaw resides in EmbedHtmlFormatter::toHtml, which builds a <figure> element using sprintf with a user-controlled class value. Because the class string is interpolated into the HTML template without contextual escaping, a double quote character inside the class value terminates the surrounding class="..." attribute. Once the attribute boundary is broken, an attacker can append arbitrary attributes such as onmouseover, onerror, or onload handlers, or inject additional markup entirely.

The payload is stored inside wiki page source and executed each time the rendered page is served, making this a persistent XSS. Any reader visiting the poisoned page becomes a target. When an administrator views the page, the injected script executes with their authenticated session, enabling privilege escalation across the wiki.

Root Cause

The underlying defect is missing output encoding when placing untrusted input into an HTML attribute context. The pre-patch formatter concatenated HTML strings with sprintf placeholders rather than using a template engine that performs context-aware escaping. Version 4.1.0 rewrites the formatter to use Mustache templates, where {{class}} is HTML-escaped by default and only explicitly opted-in fields use the raw {{{ }}} triple-brace syntax.

Attack Vector

An attacker requires only the ability to edit a wiki page that renders an EmbedVideo tag. The attacker supplies a crafted class parameter containing a quote character followed by malicious attributes or markup. When any visitor loads the page, the browser parses the injected markup and executes the attacker-controlled JavaScript in the wiki origin.

text

+<figure class="{{class}}" data-service="{{service}}" {{#iframeConfig}}data-mw-iframeconfig="{{iframeConfig}}"{{/iframeConfig}} style="{{containerStyles}}">
+	<div class="embedvideo-wrapper" style="{{wrapperStyles}}">
+		{{{wrapperContentsHtml}}}
+	</div>{{#captionHtml}}<figcaption>{{{captionHtml}}}</figcaption>{{/captionHtml}}
+</figure>

Source: GitHub Commit 3701563. The patched wrapper.mustache template replaces string interpolation with Mustache double-brace substitutions that perform automatic HTML escaping on the class, service, and style fields.

Detection Methods for CVE-2026-55691

Indicators of Compromise

Wiki page revisions containing #ev parser calls or EmbedVideo tags whose class argument includes a double quote, angle bracket, or event-handler substring such as onerror=, onload=, or onmouseover=.
Rendered HTML pages where a <figure> element produced by EmbedVideo contains unexpected attributes beyond class, data-service, data-mw-iframeconfig, and style.
Outbound requests from wiki reader browsers to attacker-controlled domains immediately after loading pages that embed video content.

Detection Strategies

Audit MediaWiki revision history for edits that modify EmbedVideo parameters, focusing on the class argument and any value containing quoting or HTML metacharacters.
Deploy a Content Security Policy (CSP) in report-only mode and monitor script-src violations originating from wiki article pages.
Scan the raw wikitext database for regex patterns targeting the vulnerable parser syntax, such as #ev:[^|]*\|[^|]*\|[^|]*"[^|]*on\w+=.

Monitoring Recommendations

Alert on anomalous JavaScript execution or DOM modifications on wiki pages that historically contained only static video embeds.
Log and review edits performed by newly registered or low-reputation accounts targeting pages that use the EmbedVideo extension.
Correlate wiki authentication events with unusual session activity, such as administrator sessions issuing API calls immediately after viewing an edited article.

How to Mitigate CVE-2026-55691

Immediate Actions Required

Upgrade the EmbedVideo extension to version 4.1.0 or later on every MediaWiki instance where it is installed.
Purge the MediaWiki parser cache after upgrading so that any previously rendered malicious markup is regenerated with the patched formatter.
Review recent edits to pages containing EmbedVideo tags and revert any revisions that inject quote characters or event handlers into the class parameter.

Patch Information

The fix is delivered in EmbedVideo v4.1.0, published in the GitHub Release v4.1.0. Commit 370156335b325bb81d14d89edf0a1f2643d50a84 rewrites EmbedHtmlFormatter to use Mustache templates that HTML-escape interpolated values by default. Full advisory context is available in GHSA-7h5p-637f-jfr7.

Workarounds

Temporarily disable the EmbedVideo extension in LocalSettings.php until the upgrade to 4.1.0 is deployed.
Restrict page editing permissions so that only trusted user groups can modify pages containing EmbedVideo tags.
Enforce a strict Content Security Policy that disallows inline scripts and event-handler attributes on wiki article responses.

bash

# Configuration example: disable EmbedVideo in LocalSettings.php until patched
# Comment out or remove the extension load line:
# wfLoadExtension( 'EmbedVideo' );

# After upgrading, verify the installed version
cd extensions/EmbedVideo
git fetch --tags
git checkout v4.1.0
php maintenance/update.php --quick