GHSA-7h5p-637f-jfr7

Suggest an improvement
Source
https://github.com/advisories/GHSA-7h5p-637f-jfr7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7h5p-637f-jfr7/GHSA-7h5p-637f-jfr7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7h5p-637f-jfr7
Aliases
Published
2026-06-19T21:15:03Z
Modified
2026-09-10T03:50:48Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Details

Summary

The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

Details

The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.

$template = <<<HTML
    <figure class="%s" data-service="%s" %s %s>
        <div class="embedvideo-wrapper" %s>%s%s%s</div>%s
    </figure>
HTML;

PoC

Note the double quote immediately following the single quote to escape the class attribute in the template:

<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>

Impact

Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.

Database specific 
{
    "cwe_ids":  [
        "CWE-79",
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T21:15:03Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Packagist / starcitizenwiki/embedvideo

Package

Name
starcitizenwiki/embedvideo
Purl
pkg:composer/starcitizenwiki/embedvideo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.1.0

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.3.0
3.4.0
3.4.1
3.4.2
3.4.3
4.*
4.0.0

Database specific

last_known_affected_version_range 
"<= 4.0.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7h5p-637f-jfr7/GHSA-7h5p-637f-jfr7.json"