GHSA-7h5p-637f-jfr7

Source

https://github.com/advisories/GHSA-7h5p-637f-jfr7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7h5p-637f-jfr7/GHSA-7h5p-637f-jfr7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7h5p-637f-jfr7

Aliases

CVE-2026-55691

Published

2026-06-19T21:15:03Z

Modified

2026-06-19T21:30:10.209943347Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

Details

Summary

The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

Details

The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.

$template = <<<HTML
    <figure class="%s" data-service="%s" %s %s>
        <div class="embedvideo-wrapper" %s>%s%s%s</div>%s
    </figure>
HTML;

PoC

Note the double quote immediately following the single quote to escape the class attribute in the template:

<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>

Impact

Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-19T21:15:03Z",
    "github_reviewed": true,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ]
}

References

Affected packages

Packagist / starcitizenwiki/embedvideo

Package

Name: starcitizenwiki/embedvideo
Purl: pkg:composer/starcitizenwiki%2Fembedvideo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.1.0

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.1.0

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.3.0

3.4.0

3.4.1

3.4.2

3.4.3

4.*

4.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7h5p-637f-jfr7/GHSA-7h5p-637f-jfr7.json"

last_known_affected_version_range

"<= 4.0.0"