High severity7.5NVD Advisory· Published Sep 24, 2026· Updated Sep 30, 2026
CVE-2026-57440
CVE-2026-57440
Description
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
starcitizenwiki/embedvideoPackagist | < 4.1.0 | 4.1.0 |
Affected products
2- Range: <4.1.0
- Range: <4.1.0
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-v65j-hff3-753cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-57440ghsaADVISORY
- github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84nvdWEB
- github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753cnvdWEB
News mentions
0No linked articles in our index yet.