Is there a patch available for CVE-2026-34089?

Yes, a patch is available for CVE-2026-34089. Update the affected software to the latest version immediately.

Wikimedia Scribunto CVE-2026-34089

Q: What is the CVSS score of CVE-2026-34089?

CVE-2026-34089 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29061 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 wikimedia-foundation

GHSA-mcf6-vhp9-g7jr

XSS Scribunto Wikimedia Foundation

2.3

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (wikimedia-foundation) · only source for this CVE.

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 18:00 vuln.today

Patch available

May 11, 2026 - 17:01 EUVD

CVSS changed

May 11, 2026 - 16:22 NVD

2.3 (LOW)

CVE Published

May 11, 2026 - 14:46 nvd

LOW 2.3

CVE Published

May 11, 2026 - 14:46 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Vulnerability in Wikimedia Foundation Scribunto.

This issue affects Scribunto: from 1.45.0 before 1.45.2.

AnalysisAI

Cross-site scripting (XSS) vulnerability in Wikimedia Scribunto 1.45.0 through 1.45.1 allows authenticated users to inject malicious scripts that may be executed in the context of other users' browsers, potentially compromising session security and enabling unauthorized actions on affected wiki installations. The vulnerability requires login credentials and elevated attack complexity but carries low availability impact; CVSS 2.3 reflects limited real-world threat when combined with the authentication requirement.

Technical ContextAI

Scribunto is a Lua scripting engine extension for MediaWiki that enables dynamic content generation through Lua modules. The vulnerability stems from improper input validation or output encoding in Scribunto's template or script processing mechanism (CWE-79: Improper Neutralization of Input During Web Page Generation). The flaw allows authenticated users to inject unvalidated user-controlled data into generated HTML, bypassing browser same-origin protections depending on context. This affects the core Scribunto extension across MediaWiki installations where the extension is enabled and where wiki markup or Lua script output is not properly sanitized.

RemediationAI

Upgrade Scribunto to version 1.45.2 or later immediately. No workarounds are available prior to patching. Wiki administrators should review Scribunto extension settings in LocalSettings.php and confirm the installed version via Special:Version in MediaWiki. After upgrade, clear browser caches and session cookies to ensure any cached XSS payloads are not replayed. For administrators unable to patch immediately, consider temporarily disabling Scribunto (set $wgScribuntoEngineConf['default'] = false;) if Lua scripting is not critical, though this will break dependent wiki functionality. Patch availability is confirmed from vendor (Wikimedia Foundation); see advisory at https://phabricator.wikimedia.org/T419168.