CVE-2026-57440
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.
Risk Assessment
An attacker can inject malicious HTML/JavaScript into a MediaWiki page, potentially leading to session hijacking or other browser-based attacks. The risk exists only when the consent requirement option is disabled.
Recommendation
Upgrade EmbedVideo Extension to version 4.1.0 or later. If upgrading is not possible, enable $wgEmbedVideoRequireConsent or restrict embedding of video from untrusted sources.
Other vulnerabilities in EmbedVideo Extension
See all- CVE-2026-55692High
The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.
- CVE-2026-55691High
The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.
- CVE-2026-55690High
The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.
Original NVD description (English source)
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS