EUVD-2026-41118
GHSA-f5m8-q8gq-mjpw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable XSS with no privileges required; UI:R used in CVSS 3.1 as victim page rendering constitutes user interaction; scope changes to victim browser context with low C/I impact.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.
AnalysisAI
Cross-site scripting in the Wikimedia Foundation's MediaWiki Charts Extension allows network-accessible, unauthenticated attackers to inject malicious JavaScript into wiki pages that render chart content. All installations running the Charts Extension across the 1.43.x, 1.44.x, and 1.45.x branches prior to fixed releases 1.43.9, 1.44.6, and 1.45.4 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 vector's PR:N and UI:N designations indicate the attack requires neither attacker credentials nor victim interaction beyond page rendering, which is atypical for classical reflected XSS and elevates practical exploitability.
Technical ContextAI
The MediaWiki Charts Extension (CPE: cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_charts_extension:*:*:*:*:*:*:*:*) is an optional add-on for the MediaWiki platform - the wiki engine powering Wikipedia and thousands of institutional, academic, and enterprise wikis - that provides in-page data visualization through chart rendering. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data fed into the Charts Extension's rendering pipeline is incorporated into generated HTML without adequate escaping or sanitization. When a browser renders the resulting page, attacker-controlled JavaScript executes in the victim's session context. The Gerrit commit reference (Ibdaa7c852ae83f562e84dddc9c96ad64e2152210) confirms an upstream code-level fix targeting the neutralization defect, and the Phabricator task T430548 tracks the disclosure and remediation lifecycle.
RemediationAI
Operators should upgrade the MediaWiki Charts Extension to the fixed releases corresponding to their active MediaWiki branch: 1.43.9, 1.44.6, or 1.45.4. The upstream fix is accessible via Gerrit at https://gerrit.wikimedia.org/r/q/Ibdaa7c852ae83f562e84dddc9c96ad64e2152210 and the disclosure is tracked at https://phabricator.wikimedia.org/T430548; note that the Gerrit reference points to a commit-level change and the formal tagged release should be verified through the MediaWiki extension registry before deployment. If immediate patching is not feasible, disabling the Charts Extension entirely eliminates the attack surface with no residual XSS risk from this component, at the cost of removing all chart rendering functionality site-wide. As a narrower compensating control, restricting wiki editing and chart submission to authenticated users (if the wiki currently permits anonymous edits) reduces the PR:N exposure to credentialed users only, though this does not eliminate the vulnerability and should not be treated as a patch substitute.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today