CVE-2025-59839

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20	Product
https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155	Product
https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01	Patch
https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v	Exploit Vendor Advisory
https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:star-citizen:embedvideo:*:*:*:*:*:mediawiki:*:*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) La extensión EmbedVideo es una extensión de MediaWiki que añade una función de analizador sintáctico llamada #ev y varias etiquetas de analizador sintáctico para incrustar videoclips de varios servicios de intercambio de videos. En las versiones 4.0.0 y anteriores, la extensión EmbedVideo permite añadir atributos arbitrarios a un elemento HTML, lo que permite XSS almacenado a través de wikitexto. Este problema ha sido parcheado mediante el commit 4e075d3.

Information

Published : 2025-09-25 14:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-59839

Mitre link : CVE-2025-59839

CVE.ORG link : CVE-2025-59839

JSON object : View

Products Affected

star-citizen

embedvideo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-59839", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59839", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-25T14:19:33.724455Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "StarCitizenWiki", "product": "mediawiki-extensions-EmbedVideo", "versions": [{"status": "affected", "version": "<= 4.0.0"}]}]}], "published": "2025-09-25T14:15:46.570", "references": [{"url": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3."}, {"lang": "es", "value": "La extensi\u00f3n EmbedVideo es una extensi\u00f3n de MediaWiki que a\u00f1ade una funci\u00f3n de analizador sint\u00e1ctico llamada #ev y varias etiquetas de analizador sint\u00e1ctico para incrustar videoclips de varios servicios de intercambio de videos. En las versiones 4.0.0 y anteriores, la extensi\u00f3n EmbedVideo permite a\u00f1adir atributos arbitrarios a un elemento HTML, lo que permite XSS almacenado a trav\u00e9s de wikitexto. Este problema ha sido parcheado mediante el commit 4e075d3."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:star-citizen:embedvideo:*:*:*:*:*:mediawiki:*:*", "vulnerable": true, "matchCriteriaId": "E9B38383-9C18-4626-B34E-C5796794E75E", "versionEndIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}