Is CVE-2026-100376 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100376 being exploited in the wild.

How severe is CVE-2026-100376?

Informational severity, published 25 September 2026.

Which products and versions are affected?

Wikimedia Foundation MediaWiki TemplateSandbox Extension before 1.46.1, 1.45.5, 1.43.10.

Is there a fix for CVE-2026-100376?

A patch was published on 2026-06-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100376 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100376?

Check whether you run Wikimedia Foundation MediaWiki TemplateSandbox Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100376: MediaWiki TemplateSandbox cross-site scripting via user namespace

CVE-2026-100376 · Severity: info · Published 2026-09-25

MediaWiki's TemplateSandbox extension allows users to preview wiki templates in a sandboxed environment. An attacker can create a malicious JavaScript file in their own user namespace, then trick another user into previewing a page with a specially crafted link and clicking a button, executing arbitrary JavaScript in the victim's browser with their full wiki privileges. This enables account compromise, data theft, or further attacks against the wiki.

Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-100376 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100376 being exploited in the wild.
How severe is CVE-2026-100376?: Informational severity, published 25 September 2026.
Which products and versions are affected?: Wikimedia Foundation MediaWiki TemplateSandbox Extension before 1.46.1, 1.45.5, 1.43.10.
Is there a fix for CVE-2026-100376?: A patch was published on 2026-06-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100376 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100376?: Check whether you run Wikimedia Foundation MediaWiki TemplateSandbox Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The TemplateSandbox extension improperly loads JavaScript and CSS from MediaWiki site pages (e.g., Common.js) when a sandbox prefix is set to any user's namespace, without validating that the prefix belongs to the viewing user. An attacker constructs a URL to Special:TemplateSandbox with prefix=User:Attacker/sandbox, creates a malicious User:Attacker/sandbox/MediaWiki:Common.js page, and tricks another user into clicking the View button, executing the attacker's script in the victim's security context. The fix restricts JS/CSS loading to only the current user's own namespace.

Affected products

Wikimedia Foundation MediaWiki TemplateSandbox Extension before 1.46.1, 1.45.5, 1.43.10

Timeline

2026-09-25: disclosed
2026-06-29: patched
2026-07-10: other: Fix proposed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.