EUVD-2026-41114
GHSA-9r5v-wvvq-6v9f
Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, unauthenticated bypass with no interaction; uniform Low C/I/A impact reflects scoped extension access, not full site compromise.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.
This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.
AnalysisAI
Authentication bypass in the Wikimedia Foundation's WikiLambda extension for MediaWiki allows unauthenticated remote attackers to circumvent access controls via improper neutralization of input terminator characters (CWE-288). Affected are all WikiLambda deployments running versions prior to 1.43.9, 1.44.6, and 1.45.4 across the supported MediaWiki release branches. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-prerequisite attack vector warrants prompt patching.
Technical ContextAI
WikiLambda is a MediaWiki extension that implements a wiki-based abstract function repository and evaluation engine, allowing wiki editors to define and execute code functions. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), compounded by improper neutralization of input terminators - characters such as null bytes, carriage returns, or other delimiters that can prematurely terminate string parsing in authentication logic. By injecting such terminators into a request parameter processed before or during auth validation, an attacker can cause the extension to traverse an alternate code path that skips the authentication gate entirely. The affected CPE is cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_wikilambda_extension, indicating the vulnerability is scoped to the extension layer rather than core MediaWiki. The Gerrit change at https://gerrit.wikimedia.org/r/c/1305376 contains the upstream fix, and the Phabricator task T428833 documents the issue timeline.
RemediationAI
Upgrade the WikiLambda extension to version 1.43.9 or later on MediaWiki 1.43.x branches, 1.44.6 or later on 1.44.x, or 1.45.4 or later on 1.45.x, per the fix versions stated in the CVE description. The upstream patch is available in Gerrit review https://gerrit.wikimedia.org/r/c/1305376 - note that while the fix commit exists, independent confirmation that all three tagged release versions have been formally packaged and published was not available from the provided references; verify against the Wikimedia Extension distributor before deploying. As a compensating control for sites unable to patch immediately, disabling the WikiLambda extension entirely removes the attack surface with no impact on core MediaWiki functionality; alternatively, restricting access to the WikiLambda API endpoints (typically under /api.php with WikiLambda action parameters) via web server ACLs or a WAF rule can limit exploitation to internal networks, though this may break legitimate extension use.
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today