High severityNVD Advisory· Published Jun 19, 2026· Updated Jun 19, 2026
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
CVE-2026-55691
Description
Summary
The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.
Details
The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.
$template = <<<HTML
%s%s%s%s
HTML;
PoC
Note the double quote immediately following the single quote to escape the class attribute in the template: `` dQw4w9WgXcQ ``
Impact
Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
starcitizenwiki/embedvideoPackagist | < 4.1.0 | 4.1.0 |
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-7h5p-637f-jfr7ghsaADVISORY
- github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84ghsaWEB
- github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0ghsaWEB
- github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7ghsaWEB
News mentions
0No linked articles in our index yet.