{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.0.0"}],"component":"starcitizenwiki/embedvideo","cve_ids":["CVE-2025-59839"],"ecosystem":"Packagist","epss":0.0031,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4j5h-mvj3-m48v","id":"tcs_01M5KEV1XXCPWNPAWVYCN2VM7A","modified_at":"2026-09-10T03:50:27.926243875Z","published_at":"2025-09-24T20:11:17Z","references":["https://osv.dev/vulnerability/GHSA-4j5h-mvj3-m48v","https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v","https://nvd.nist.gov/vuln/detail/CVE-2025-59839","https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01","https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo","https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20","https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-4j5h-mvj3-m48v","url":"https://osv.dev/vulnerability/GHSA-4j5h-mvj3-m48v"}],"summary":"Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes"}