Overview
CVE-2025-59839 is a severe vulnerability affecting the EmbedVideo Extension in MediaWiki’s versions 4.0.0 and prior. This extension is widely used for embedding video clips from various video sharing services into MediaWiki pages. The vulnerability allows an attacker to add arbitrary attributes to an HTML element, leading to a stored Cross-Site Scripting (XSS) attack through wikitext. This vulnerability is of grave concern as it opens the potential for system compromise and data leakage, which could have dire consequences for any organization using the affected versions of the EmbedVideo Extension.
Vulnerability Summary
CVE ID: CVE-2025-59839
Severity: High (8.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
MediaWiki EmbedVideo Extension | 4.0.0 and prior
How the Exploit Works
The vulnerability arises due to the EmbedVideo Extension’s ability to add arbitrary attributes to an HTML element through wikitext. An attacker can exploit this vulnerability by crafting malicious wikitext that includes harmful attributes. When a user views a page containing this malicious wikitext, the harmful attributes are executed in the user’s browser, leading to a stored XSS attack. This could allow the attacker to execute arbitrary scripts in the context of the user’s session, potentially leading to unauthorised actions or data theft.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited through a crafted wikitext:
{{#ev:youtube|<img src=x onerror=alert('XSS') />}}This wikitext attempts to embed a YouTube video, but it includes a malicious ‘onerror’ attribute in an image tag. If the image fails to load, the ‘onerror’ attribute triggers, executing the JavaScript alert function and displaying a message box with the text ‘XSS’. In a real-world attack, this benign alert could be replaced with a more malicious script, such as one that steals the user’s session cookies.
