CVE-2026-55692: MediaWiki EmbedVideo Extension XSS Vulnerability

CVE-2026-55692 Overview

CVE-2026-55692 is a stored cross-site scripting (XSS) vulnerability in the MediaWiki EmbedVideo Extension prior to version 4.1.0. The flaw resides in includes/EmbedService/EmbedHtmlFormatter.php, which places JSON output from AbstractEmbedService.php into the data-mw-iframeconfig attribute without escaping single quotes. Attackers can supply crafted archiveorg identifiers or wistia/sharepoint URLs that pass the service validators, then break out of the attribute and inject event-handler attributes into the generated <figure> element. Any user with edit permissions can store JavaScript that executes in the wiki origin when other visitors render the page.

Critical Impact
Authenticated wiki editors can inject persistent JavaScript that executes in the browsers of all visitors, enabling session hijacking and account takeover within the wiki origin.

Affected Products

MediaWiki EmbedVideo Extension versions prior to 4.1.0
Installations with default $wgEmbedVideoRequireConsent configuration enabled
Wikis accepting archiveorg, wistia, or sharepoint embeds

Discovery Timeline

2026-09-15 - CVE-2026-55692 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55692

Vulnerability Analysis

The EmbedVideo extension adds a #ev parser function and parser tags that render embedded video players inside MediaWiki pages. When $wgEmbedVideoRequireConsent is enabled, the extension wraps each embed in a consent container and stores iframe configuration as JSON inside the data-mw-iframeconfig HTML attribute. The formatter concatenates that JSON into a single-quoted attribute value without escaping embedded single quotes. An attacker who provides a service identifier containing a ' character can terminate the attribute early and append arbitrary attributes, including DOM event handlers such as onmouseover or onload, to the outer <figure> element. The injected handler runs in the wiki origin, giving the payload access to session cookies, CSRF tokens, and the MediaWiki API on behalf of any visitor who views the page.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The getUrl() output from service validators for Archive.org, Wistia, and SharePoint returns attacker-influenced strings that are interpolated into an HTML attribute without single-quote escaping. The service validators accept characters that are safe for URL contexts but unsafe when embedded inside a single-quoted JSON attribute value.

Attack Vector

Exploitation requires an attacker to have edit access to a wiki page and to insert an EmbedVideo tag referencing one of the vulnerable services with a payload that breaks out of the data-mw-iframeconfig attribute. When any visitor renders the page, the browser parses the injected event handler and executes the attacker's JavaScript in the wiki's origin.

text

// Patched wrapper template (v4.1.0) – mustache auto-escapes attribute values
<figure class="{{class}}" data-service="{{service}}" {{#iframeConfig}}data-mw-iframeconfig="{{iframeConfig}}"{{/iframeConfig}} style="{{containerStyles}}">
	<div class="embedvideo-wrapper" style="{{wrapperStyles}}">
		{{{wrapperContentsHtml}}}
	</div>{{#captionHtml}}<figcaption>{{{captionHtml}}}</figcaption>{{/captionHtml}}
</figure>

Source: GitHub commit 3701563

Detection Methods for CVE-2026-55692

Indicators of Compromise

Rendered wiki pages containing <figure> elements with unexpected event-handler attributes such as onmouseover, onclick, or onerror adjacent to data-mw-iframeconfig.
Wiki revision history showing #ev parser calls with archiveorg, wistia, or sharepoint service identifiers that include single-quote characters.
Outbound requests from client browsers to attacker-controlled domains immediately after loading a page that embeds these services.

Detection Strategies

Scan the MediaWiki text and revision tables for stored content matching {{#ev:(archiveorg|wistia|sharepoint) followed by suspicious characters including ', <, or on[a-z]+=.
Review rendered HTML output for data-mw-iframeconfig attributes whose values contain unescaped quote sequences or trailing HTML attributes.
Correlate wiki edit logs with subsequent browser-side script execution telemetry from endpoint or browser monitoring tools.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the wiki to surface inline script or event-handler executions that violate policy.
Log and alert on MediaWiki edits by newly registered accounts that add EmbedVideo tags for the affected services.
Monitor web server access logs for anomalous cross-origin requests originating from wiki page loads.

How to Mitigate CVE-2026-55692

Immediate Actions Required

Upgrade the EmbedVideo extension to version 4.1.0 or later on all MediaWiki installations.
Audit existing wiki pages for EmbedVideo tags referencing archiveorg, wistia, or sharepoint services and revert suspicious revisions.
Rotate administrative session tokens and force re-authentication for privileged wiki accounts if exploitation is suspected.

Patch Information

The maintainers released version 4.1.0, which rewrites EmbedHtmlFormatter to use Mustache templates that automatically escape attribute values. See the GitHub Release v4.1.0 and the GitHub Security Advisory GHSA-5c7p-g73q-rpg5 for details.

Workarounds

Disable the EmbedVideo extension until version 4.1.0 can be deployed.
Set $wgEmbedVideoRequireConsent = false in LocalSettings.php to bypass the vulnerable consent container path, accepting the privacy trade-off.
Restrict page-edit permissions to trusted users and require review of edits containing EmbedVideo parser tags.

bash

# Upgrade EmbedVideo to the patched version
cd /var/www/mediawiki/extensions/EmbedVideo
git fetch --tags
git checkout v4.1.0
php /var/www/mediawiki/maintenance/update.php --quick