MediaWiki EmbedVideo Extension Vulnerability in Version Prior to 4.1.0
CVE-2026-55691

8.6HIGH

Key Information:

Vendor: Starcitizenwiki
Status: Mediawiki-extensions-embedvideo
Vendor: CVE Published:; 15 September 2026

🔔 Create Starcitizenwiki Vulnerability Alert

What is CVE-2026-55691?

The EmbedVideo Extension in MediaWiki has a vulnerability that allows an attacker to inject arbitrary HTML or JavaScript into wiki pages. This is due to the improper handling of user-supplied input in the class attribute of the figure element. When users with editing permissions craft a specific class value containing a quote, it can terminate the class attribute, leading to potential execution of malicious JavaScript for visitors. This issue was addressed in version 4.1.0, emphasizing the importance of updating to safeguard against possible exploits.