Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player

Report facts: CERT/CC disclosed two unpatched vulnerabilities (CVE-2026-19913 and CVE-2026-19912) in Kaltura’s HTML5 mwEmbed video player, caused by unsafe deserialization in the mwEmbedLoader.php endpoint. These flaws allow remote, unauthenticated attackers to read arbitrary files from the server and execute code. RealGround analysis: While the bug is in a traditional web component, compromised Kaltura infrastructure or hosting environments used by AI applications can become a pivot point for exfiltrating AI configuration files, credentials, or model artifacts, and for deploying malicious code that tampers with AI pipelines. Organizations should treat such third-party libraries as part of their AI supply chain, ensure SBOM coverage, and incorporate routine security readiness assessments to detect and remediate these upstream risks.