EUVD-2026-87349
GHSA-45r6-8hjm-wh6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged wiki author account
-
DeliveryInject script payload into WikiLambda content
-
ExploitVictim views crafted page
-
ExecutionScript executes in victim browser origin
-
ImpactLow-impact data disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker with high privileges on the wiki (PR:H - an elevated content-authoring/admin role in the WikiLambda extension) to inject the payload, plus victim user interaction (UI:P - a target must view the crafted WikiLambda content) for the script to fire. Exploitation is further limited to MediaWiki instances that have the WikiLambda extension installed AND are running the pre-release version 1.47.0-alpha; the fix exists only on the master branch, so no stable numbered release is impacted. This confines realistic exposure to development/alpha deployments of a specialized extension. |
| Impact | This is a genuinely low-priority XSS despite the CWE-79 label. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N, score 4.8/Medium) contains two strong gating factors: PR:H means the attacker must already hold high privileges (an elevated content author/admin role on the wiki) to inject the payload, and UI:P means a victim must actively interact with the crafted content. Technical impact is limited to VC:L (low confidentiality) with no integrity or availability impact claimed. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description; both point to a privileged, interaction-dependent, low-impact issue. The one notable nuance is that the affected version is a single pre-release build (1.47.0-alpha), remediated only on the master branch rather than a shipped stable release, which sharply narrows the realistically exposed population. Net: a real but minor hardening fix, not an urgent priority. |
| Exploit ScenarioDerived | A user with elevated authoring/admin rights on a MediaWiki instance running the WikiLambda extension injects a crafted script payload into a WikiLambda object or field. When another user (e.g. an admin or reviewer) opens the affected page, the script executes in their browser under the wiki's origin, enabling limited disclosure of session-scoped data. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Cross-site scripting in the WikiLambda extension for MediaWiki allows a high-privileged wiki contributor to store script-bearing markup that executes in the browser of another user who views the crafted content, giving limited client-side impact (CVSS 3.1 base vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; vendor-published CVSS 4.0 score 4.8). Only the pre-release version 1.47.0-alpha of the extension is affected, and the flaw has been remediated on the master branch, so no stable numbered MediaWiki release carries the vulnerable code; realistic exposure is confined to development or alpha deployments that have installed the extension. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuinely low-priority XSS despite the CWE-79 label.
RemediationAI
The upstream fix is available on the WikiLambda master branch via Gerrit change https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326391 (tracked in Phabricator task https://phabricator.wikimedia.org/T434967); because the remediation is a master-branch commit and no tagged released version is confirmed in the input data, treat this as an upstream fix rather than a certified patched release and update the extension from master or from the next official release that contains the change. Do not deploy 1.47.0-alpha WikiLambda in production, and where the extension is already present on a pre-release deployment, roll back to a build predating the alpha change until the patched revision is applied. Because exploitation requires an elevated role in the extension plus victim interaction, effective compensating controls are to restrict creation and editing of WikiLambda/ZObject content to a small set of trusted users (removing risky rights from broad contributor groups), to leave the extension disabled entirely on wikis that do not need Wikifunctions functionality, and to add a restrictive Content-Security-Policy header in MediaWiki so that any injected script is blocked from executing. The trade-offs are that tightening edit rights degrades the collaborative authoring workflow the extension is designed for, disabling WikiLambda removes Wikifunctions features outright, and a strict CSP can break legitimate inline scripts and gadgets used elsewhere on the wiki, so it should be staged and tested before enforcement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation: content handled by the WikiLambda extension is emitted into the generated MediaWiki HTML page without adequate escaping or output encoding, so attacker-supplied markup survives into the response in an executable context. WikiLambda implements the Wikifunctions data model inside MediaWiki, letting users author, store and render function-related objects (ZObjects) and their representations; the vulnerable path is the rendering of that content rather than MediaWiki core itself. Per the EUVD record and the affected-version data, the only impacted artifact is the extension at 1.47.0-alpha, meaning the defect was introduced on the development line and fixed before a stable release was cut. Exploitation prerequisites are significant and are confirmed by the assessed CVSS vector (PR:H, UI:R/UI:P): the attacker already needs an elevated content-authoring or administrative role inside the extension, and a separate victim must open the tainted content for the injected script to run. The vendor CVSS 4.0 vector records scope-unchanged subsequent-system impact (SC:N/SI:N/SA:N) with low confidentiality impact only, while the independent assessment scores S:C with low confidentiality and integrity impact; both readings agree on limited, client-side-only consequences and no availability or server-side compromise.
Know when Mediawiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Privileged author injects payload (PR:H) that a victim must view (UI:R); script escapes into the victim's browser context (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (c4f26cc8-17ff-4c99-b5e2-38fc1793eacc).
CVSS VectorVendor: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4,
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Rated critical severity (CVSS 9.8), thi
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnera
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun
An issue was discovered in the FileImporter extension in MediaWiki through 1.36. Rated high severity (CVSS 8.8), this vu
Exploit-DB