Wikimedia Scribunto CVE-2026-34089

Exploitation requires the attacker to possess a valid wiki user account with edit permissions in at least one namespace where Scribunto modules or templates can be created or modified (typically Template or Module namespace on public wikis, but restricted on private/internal wikis). The Scribunto extension must be installed and enabled in the MediaWiki instance. The vulnerable code path is triggered when Scribunto processes Lua output or template parameters that are not properly escaped before HTML rendering. Wikis with strict edit controls, pending changes review, or disabled Scribunto extension are not vulnerable. The XSS payload executes only when a different user views the affected page, requiring implicit user interaction (page visit) rather than direct attacker action.

Risk is significantly lower than raw CVSS suggests. CVSS 4.0 vector indicates attack vector network (accessible remotely) but attack complexity high and privileges required (login needed), limiting real-world exploitation. EPSS data not provided; however, the authentication barrier (PR:L) and high attack complexity substantially reduce exploitability compared to unauthenticated network vulnerabilities. No KEV status, no public POC, and no indication of active exploitation suggest this is a controlled-risk issue affecting only authenticated wiki editors. The low availability impact (VA:L) and zero confidentiality/integrity impacts on the system itself indicate XSS affects user browsers, not server infrastructure. Realistic priority is medium for wiki operators with public editable namespaces but low for closed-wiki deployments with restricted editor access.

A logged-in wiki editor crafts a Lua module or template that injects malicious JavaScript through Scribunto's output generation. When the resulting wiki page is rendered and viewed by other editors or administrators, the injected script executes in their browsers with the permissions of their wiki accounts, potentially stealing session cookies, modifying page content, or escalating privileges if the viewer holds admin rights.