CVE-2025-59839 | THREATINT

Description

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

PUBLISHED Reserved 2025-09-22 | Published 2025-09-25 | Updated 2025-09-25 | Assigner GitHub_M

HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

<= 4.0.0

affected

References

github.com/...dVideo/security/advisories/GHSA-4j5h-mvj3-m48v

github.com/...ommit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01

github.com/...1d1c202d/resources/ext.embedVideo.videolink.js

github.com/...4c1d31d58a1d1c202d/resources/modules/iframe.js

cve.org (CVE-2025-59839)

nvd.nist.gov (CVE-2025-59839)

Download JSON