CVE-2026-57440
Received Received - Intake

Stored XSS in EmbedVideo MediaWiki Extension

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-57440
EUVD
EUVD-2026-86396

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The EmbedVideo Extension for MediaWiki allows embedding videos from various services using parser functions. Prior to version 4.1.0, if a specific setting is disabled, video URLs are passed into an iframe src attribute without proper sanitization. This allows attackers to inject malicious HTML or JavaScript by providing a malformed URL that escapes the src attribute using double quotes.

Detection Guidance

Check MediaWiki extensions for EmbedVideo version below 4.1.0. Inspect iframe src attributes in rendered pages for unsanitized URLs or malformed inputs that could allow injection. Review server logs for unusual HTML or JavaScript execution patterns.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary JavaScript in the context of the affected website. This could lead to theft of session cookies, account takeover, or defacement of the site. Users visiting pages with embedded videos could unknowingly run malicious scripts.

Compliance Impact

This vulnerability allows HTML/javascript injection via iframe src attributes due to unsanitized video URLs, which could lead to unauthorized data access or manipulation. This may violate GDPR's data protection requirements for secure processing and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade EmbedVideo Extension to version 4.1.0 or later. Enable $wgEmbedVideoRequireConsent to enforce consent before embedding. Sanitize all video URLs and IDs before rendering. Monitor for signs of exploitation in logs and network traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart