Overview
CVE-2025-59839 is a severe vulnerability affecting the EmbedVideo Extension in MediaWiki’s versions 4.0.0 and prior. This extension is widely used for embedding video clips from various video sharing services into MediaWiki pages. The vulnerability allows an attacker to add arbitrary attributes to an HTML element, leading to a stored Cross-Site Scripting (XSS) attack through wikitext. This vulnerability is of grave concern as it opens the potential for system compromise and data leakage, which could have dire consequences for any organization using the affected versions of the EmbedVideo Extension.
Vulnerability Summary
CVE ID: CVE-2025-59839
Severity: High (8.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
MediaWiki EmbedVideo Extension | 4.0.0 and prior
How the Exploit Works
The vulnerability arises due to the EmbedVideo Extension’s ability to add arbitrary attributes to an HTML element through wikitext. An attacker can exploit this vulnerability by crafting malicious wikitext that includes harmful attributes. When a user views a page containing this malicious wikitext, the harmful attributes are executed in the user’s browser, leading to a stored XSS attack. This could allow the attacker to execute arbitrary scripts in the context of the user’s session, potentially leading to unauthorised actions or data theft.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited through a crafted wikitext:
{{#ev:youtube|<img src=x onerror=alert('XSS') />}}This wikitext attempts to embed a YouTube video, but it includes a malicious ‘onerror’ attribute in an image tag. If the image fails to load, the ‘onerror’ attribute triggers, executing the JavaScript alert function and displaying a message box with the text ‘XSS’. In a real-world attack, this benign alert could be replaced with a more malicious script, such as one that steals the user’s session cookies.