MediaWiki CirrusSearch CVE-2026-96873

Requires the target MediaWiki installation to have the CirrusSearch extension deployed (version through 1.46.0) and a victim to click an attacker-crafted search link - reflected XSS is not self-triggering. Limiting factors: exploitation is client-side only (Low confidentiality, no integrity/availability impact), value is highest against authenticated users whose sessions can be hijacked, and despite the vendor's UI:N rating the reflected nature means user interaction (opening the malicious URL) is realistically necessary. CirrusSearch is an add-on, not MediaWiki core, so only wikis that have installed it (typically Elasticsearch-backed deployments) are affected.

This is a genuine but moderate-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, score 5.5) marks it network-exploitable, low-complexity, no privileges - but the vulnerability class (Reflected XSS, CWE-79) inherently requires a victim to interact with an attacker-supplied link, so the vendor's UI:N is atypical for reflected XSS and likely understates the required user interaction (UI:P/UI:R is more defensible). Confidentiality impact is Low and integrity/availability are None, so this is a session/credential-theft or action-on-behalf-of-user risk in the victim's browser context, not a server compromise. The CVSS 4.0 exploit-maturity flag E:P (Proof-of-Concept) is the strongest exploitation signal present, but no actual exploit code is linked in the references - only a Gerrit patch and a Phabricator tracking task. There is no KEV listing and no EPSS score in the input. Net: a real, patch-worthy client-side flaw for MediaWiki operators running CirrusSearch, but not an urgent mass-exploitation priority - it is UI-gated and low-impact. Key uncertainty: the vendor's UI:N contradicts the reflected-XSS class; verify whether exploitation truly needs no victim interaction.

An attacker crafts a malicious search URL for a wiki running the CirrusSearch extension, embedding a JavaScript payload in a reflected parameter, and lures an authenticated user (e.g., via a link in a wiki page, email, or chat) into clicking it. When the victim's browser renders the search result page, the unsanitized input executes in the wiki's origin, allowing session-token theft or actions performed as the victim. The CVSS 4.0 vector flags exploit maturity as Proof-of-Concept (E:P), though no public exploit code is referenced.