CVE-2025-59839
BaseFortify
Publication date: 2025-09-25
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| star-citizen | embedvideo | to 4.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-59839 is a stored Cross-Site Scripting (XSS) vulnerability in the MediaWiki EmbedVideo extension (versions 4.0.0 and prior). The extension allowed users to add arbitrary HTML attributes to iframe elements via a data attribute named 'data-iframeconfig' through wikitext. This enabled attackers to inject malicious JavaScript code that would execute in other users' browsers when they viewed the affected wiki pages. The vulnerability arises because the extension's JavaScript reads JSON from this attribute and applies it as iframe attributes, including dangerous event handlers like 'onload', leading to stored XSS attacks. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript in the browsers of users who view the affected wiki pages. This can lead to session hijacking, data theft, or other malicious actions performed in the context of the victim's session. Since the attack is stored XSS, the malicious code persists on the server and affects all users who access the compromised content. The vulnerability has a high severity with a CVSS score of 8.6, indicating significant risk. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for wiki pages containing the vulnerable EmbedVideo extension usage with the 'data-iframeconfig' attribute in HTML elements, especially divs with class 'embedvideo-evl'. You can look for occurrences of 'data-iframeconfig' in your MediaWiki content or database. Additionally, inspecting rendered pages for elements with 'data-iframeconfig' attributes or monitoring network traffic for such payloads may help. For example, you can use grep or similar commands on your MediaWiki content files or database exports: 1) grep -r 'data-iframeconfig' /path/to/mediawiki 2) Use SQL queries to find pages containing 'data-iframeconfig' in the wikitext. Also, testing with crafted HTML like `<div class="embedvideo-evl" data-iframeconfig='{"onload": "alert(1)"}'>Click me!</div>` can confirm if the vulnerability is present. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the EmbedVideo extension to a version that includes the patch which renames the vulnerable 'data-iframeconfig' attribute to 'data-mw-iframeconfig', as done in commit 4e075d3. This patch prevents arbitrary HTML attribute injection via wikitext. If updating is not immediately possible, restrict editing permissions to trusted users to prevent injection of malicious wikitext, and consider sanitizing or removing any existing content using the 'data-iframeconfig' attribute. Monitoring and removing suspicious pages containing this attribute can also reduce risk. [1]