CVE-2026-57440: Starcitizenwiki/embedvideo Cross-Site Scripting Vulnerability
HIGHCVE-2026-57440 is a HIGH (CVSS 7.5) cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting Starcitizenwiki/embedvideo libraries in the Packagist ecosystem. The issue involves mediawiki embedvideo extension has stored xss via malformed src url with $wgembedvideorequireconsent disabled. Remediation is available by upgrading affected packages to version 4.1.0.
CVE-2026-57440 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-57440
To remediate this vulnerability, upgrade all affected Starcitizenwiki/embedvideo dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade starcitizenwiki/embedvideo to 4.1.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for starcitizenwiki/embedvideoHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-57440, inspect your project dependencies for Starcitizenwiki/embedvideo:
inspect dependencies for starcitizenwiki/embedvideoAnalyze the terminal output to locate any version of Starcitizenwiki/embedvideo in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.1.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In Starcitizenwiki/embedvideo, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-57440 Affected Starcitizenwiki/embedvideo Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
starcitizenwiki/embedvideo
|
Packagist |
< 4.1.0
|
4.1.0
|
References
Frequently Asked Questions
What is CVE-2026-57440?
Which Starcitizenwiki/embedvideo versions are affected?
What version fixes CVE-2026-57440?
Is starcitizenwiki/embedvideo affected?
What is the CVSS score of CVE-2026-57440?
What CWE is associated with CVE-2026-57440?
How can I check Packagist dependencies for CVE-2026-57440?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-v65j-hff3-753c",
"modified" : "2026-09-25T15:03:43Z",
"published" : "2026-09-25T15:03:43Z",
"aliases" : [ "CVE-2026-57440" ],
"summary" : "Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled",
"details" : "### Summary\nWith $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection.\n\n### Details\nThe iframe assembled [here](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/a573a16d925ee0ea0d34b360856dc8ab0b88f822/includes/EmbedService/EmbedHtmlFormatter.php#L204-L208) adds the url from `getUrl()` as the src without sanitization.\nThe id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced.\n\n### PoC\nUsing double quotes, the src attribute can be escaped.\n```\n<embedvideo service=\"archiveorg\" id='a\" onmouseover=\"alert(document.domain)\" data-x=\"'></embedvideo>\n```\n\n### Impact\nWhen $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "starcitizenwiki/embedvideo"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.1.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.0.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-57440"
}, {
"type" : "WEB",
"url" : "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79", "CWE-80" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-09-25T15:03:43Z",
"nvd_published_at" : "2026-09-24T19:17:14Z"
}
}