Mediawiki Growthexperiments Extension EUVD-2026-19978

The vulnerability (CWE-835: Loop with Unreachable Exit Condition) resides in the GrowthExperiments Extension for MediaWiki, a Wikimedia Foundation extension that facilitates new user onboarding and growth. The root cause involves a TOCTOU race condition where a condition checked at one point in code execution is no longer valid by the time the code attempts to use that condition to exit a loop. This timing window allows an attacker to modify state between the check and the actual use, causing the loop's exit condition to never be satisfied. The vulnerability is exposed via the network (AV:N) with low attack complexity (AC:L) and no authentication requirement (PR:N), making it remotely accessible. The CVSS 4.0 vector indicates low impact across confidentiality, integrity, and availability dimensions, typical of a resource exhaustion or denial of service issue rather than data breach or system compromise.