MediaWiki WikiLambda CVE-2026-103046

Requires the Wikimedia MediaWiki WikiLambda extension (the software behind Wikifunctions/Abstract Wikipedia) at a version before 1.46.1. The attacker must be able to store content processed by WikiLambda (e.g., a ZObject / function definition) containing an unneutralized script payload, and a victim must subsequently view the rendered page (UI:R). Limiting factors: exploitation depends on this specific, narrowly-deployed extension being installed; impact is bounded to Low C/I with no availability effect; the vendor vector lists PR:N but in practice saving stored content typically requires an authenticated editing account, further constraining who can plant the payload. Highest-value outcome is hitting a privileged (admin) viewer.

This is a moderate-severity Stored XSS (CVSS 6.1) that behaves as a genuine-but-low-urgency issue rather than an emergency. The signals are consistent and point the same direction: CISA's SSVC framework rates Exploitation as 'none' (no known exploitation), Automatable as 'no', and Technical Impact as 'partial' - all of which align with a scope-changing but limited-impact XSS. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reach with low complexity but requires victim interaction (UI:R) and yields only Low confidentiality/integrity impact with a changed scope (attacker script executing in the victim's browser session against the wiki origin). One notable tension: the vector claims PR:N (unauthenticated), yet a Stored XSS in a MediaWiki content extension typically requires the attacker to first save malicious content (ZObjects/function definitions in WikiLambda), which normally needs edit privileges - verify with vendor whether unauthenticated content storage is truly possible, otherwise PR:L is more realistic. The self-report by the Wikimedia Foundation with an available patch and Gerrit changeset indicates a responsibly disclosed, vendor-fixed defect rather than an actively exploited one.

An attacker with the ability to save WikiLambda content (a function, implementation, or other ZObject) injects a crafted payload that is not properly neutralized during page generation, so it is stored and later rendered as executable script. When another user - potentially an administrator - views the affected WikiLambda page, the script runs in their browser under the wiki's origin, enabling session/token theft or actions in the victim's authenticated context. No public exploit code has been identified, and successful attack requires a victim to view the poisoned page (UI:R).