CVE-2026-57440: Stored Cross-Site Scripting (XSS) in MediaWiki EmbedVideo Extension

The EmbedVideo extension for MediaWiki, developed by StarCitizenWiki, allows wiki contributors to embed audio and video files from external platforms directly into wiki articles. This functionality is implemented via the custom parser function #ev and other specialized parser tags. The component is widely used within individual media-focused wikis to enrich page content with remote streams from sites such as YouTube, Vimeo, Archive.org, and various corporate video solutions.

Under certain configurations, specifically when video-loading consent restrictions are disabled ($wgEmbedVideoRequireConsent = false), the extension exposes an attack surface through its HTML parsing and formatting functions. The lack of proper sanitization during direct HTML output generation introduces a severe stored cross-site scripting (XSS) vulnerability. Any user with page editing capabilities can leverage this vulnerability to insert malicious input that is subsequently rendered for other users.

This vulnerability is tracked as CVE-2026-57440 and has been assigned a CVSS v3.1 base score of 7.5. The primary consequence is the capability for unauthorized execution of arbitrary script commands within the browser sessions of visiting users, including elevated administrative roles.

The attack vector is entirely remote and requires low complexity. On open wikis, anonymous users or newly created accounts can exploit the vulnerability immediately. Even on closed or moderated wikis, any user with basic page-editing rights can execute this attack, bypass standard security filters, and target internal users and administrators.

The core deficiency resides in the manual concatenation and formatting of the HTML <iframe> tag within includes/EmbedService/EmbedHtmlFormatter.php. When explicit consent overlays are disabled, the system invokes the makeIframe() function to output the element immediately. The function dynamically aggregates tag attributes and compiles them using raw string operations without calling any neutralization or sanitization routines.

The logic uses sprintf to map over the attribute key-value pairs and generate output strings in the format key="value". No context-aware escaping, such as htmlspecialchars() or MediaWiki's native escaping helpers, is applied to the values before formatting. Consequently, if the $service->getUrl() method returns a string that contains a double quotation mark, the structure of the resulting HTML attribute is broken.

An attacker can exploit this structural weakness by supplying input parameters that break out of the src attribute context. By injecting a double quote, the attacker can insert arbitrary attributes, such as onload or onerror event handlers, which the browser parses and executes as native script blocks. This represents a classic instance of CWE-79 and CWE-80, occurring because the input boundaries are not preserved during serialization.

The vulnerability is highly persistent because MediaWiki heavily caches rendered parser outputs. Once a page containing the malicious payload is rendered, the raw HTML is stored in the objectcache or parsercache database tables. Every subsequent viewer requests the cached HTML directly, which triggers the execution of the payload without re-running the parser or performing validation.

A detailed look at the vulnerable implementation of the makeIframe() method reveals the insecure manual format mapping:

public static function makeIframe( AbstractEmbedService $service ): string {
    ...
    $attributes[$srcType] = $service->getUrl();
 
    $out = array_map( static function ( $key, $value ) {
        return sprintf( '%s="%s"', $key, $value );
    }, array_keys( $attributes ), $attributes );
 
    return sprintf( '<iframe %s></iframe>', implode( ' ', $out ) );
}

In this vulnerable implementation, each key-value pair is directly interpolated into a double-quoted string. When an attribute value like $service->getUrl() contains raw quotation marks, the browser interprets the first matching quotation mark as the termination of the src attribute. This permits any subsequent characters to be interpreted as separate HTML attributes inside the <iframe> tag.

The official patch committed in version 4.1.0 completely eliminates this vulnerability by migrating the HTML serialization process to MediaWiki's robust, secure framework functions. Specifically, the manual string formatting is replaced with Html::element():

public static function makeIframe( AbstractEmbedService $service ): string {
    ...
    $attributes[$srcType] = $service->getUrl();
 
    return Html::element( 'iframe', $attributes );
}

The Html::element() helper automatically handles the attribute serialization and ensures that all key-value pairs are properly escaped using context-aware sanitization filters. This ensures that any quotation marks present in the URL are safely encoded as ", preventing any possibility of attribute breakout. Additionally, the patch refactors the outer figure template to use mustache files and MediaWiki's TemplateParser instead of inline heredocs, which significantly hardens the codebase against format-string and layout-injection variants.

Exploitation of CVE-2026-57440 requires three distinct prerequisites. First, the MediaWiki installation must run a vulnerable version of the EmbedVideo extension prior to version 4.1.0. Second, the server configuration must have explicit video consent disabled via $wgEmbedVideoRequireConsent = false. Third, the threat actor must possess the permissions necessary to edit or create wiki articles on the targeted instance.

To conduct the attack, the threat actor constructs a page with a malformed parser tag containing double quotes within a permissive service provider ID. Some service definitions, such as those for Archive.org, SharePoint, or Wistia, use patterns that allow the inclusion of double quotes without failing regex validation. A typical malicious syntax submitted to the wiki parser is represented below:

{{#ev:archiveorg|2024-12-21" onload="javascript:alert(document.domain)" style="display:none}}

When the parser processes this input, the EmbedVideo service handler resolves the parameters and passes them to EmbedHtmlFormatter::makeIframe(). The resulting HTML output is written into the page cache as shown below:

<iframe src="//archive.org/embed/2024-12-21" onload="javascript:alert(document.domain)" style="display:none"></iframe>

When standard users or administrators navigate to the affected wiki page, their browser parses the cached HTML. The browser instantiates the <iframe> element, parses the injected onload attribute, and executes the specified JavaScript commands under the host wiki's origin. This can be used to extract active session tokens or perform background operations with the victim's privileges.

The impact of a successful exploit of CVE-2026-57440 is high. Stored cross-site scripting vulnerabilities allow permanent script execution without requiring the attacker to trick individual users into clicking malicious external links. Because the payload is saved in the wiki database and cached, it runs automatically whenever any visitor accesses the contaminated page.

In a standard MediaWiki deployment, administrators regularly audit and edit pages. If an administrator views a compromised article, the injected script executes within the context of their administrative session. This enables the script to perform state-changing transactions, such as creating new administrator accounts, modifying sensitive system configurations, or exfiltrating private databases.

Furthermore, the vulnerability allows for silent data collection and session hijacking. Injected JavaScript can access the document.cookie property (unless protected by HttpOnly flags) or read session tokens from local storage. The stolen authentication credentials can then be transmitted to an external server controlled by the attacker, leading to persistent administrative compromise.

The primary and recommended remediation is to upgrade the EmbedVideo extension to version 4.1.0 or later. This version replaces all insecure manual concatenation steps with MediaWiki's standard HTML helper classes, effectively blocking the injection vector. The update also updates local-video template formatting to use safe Mustache templates.

In environments where upgrading the extension is not immediately feasible, administrators should enforce the consent system by adding or modifying the following variable in LocalSettings.php:

$wgEmbedVideoRequireConsent = true;

When enabled, this directive forces the extension to wrap videos inside an interactive overlay, preventing the direct execution of the vulnerable makeIframe function during page load. Additionally, security teams can deploy a robust Content Security Policy (CSP) with a strict script-src directive that excludes 'unsafe-inline'. This prevents the browser from executing inline event handlers like onload and onerror even if an attacker successfully injects them into the iframe tag.