The EmbedVideo extension for MediaWiki adds parser functions to embed videos from various services. Before version 4.1.0, when $wgEmbedVideoRequireConsent was disabled, the extension did not sanitize video URLs before inserting them into iframe src attributes. This improper neutralization of input (CWE-79) allowed injection of arbitrary HTML or JavaScript by escaping the iframe src attribute via double quotes in malformed URLs or IDs. Version 4.1.0 contains a fix that properly sanitizes these inputs to prevent injection.

Successful exploitation could allow an attacker to execute arbitrary HTML or JavaScript in the context of the vulnerable MediaWiki site, potentially leading to theft of user credentials or session tokens. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no indication of known exploits in the wild at this time.

Upgrade the EmbedVideo extension to version 4.1.0 or later, which contains the official patch fixing the input sanitization issue. If upgrading is not immediately possible, ensure that the configuration setting $wgEmbedVideoRequireConsent is enabled to mitigate the risk by requiring user consent before embedding videos. Patch status is confirmed by the vendor advisory indicating the fix in 4.1.0.