Is CVE-2026-100383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100383 being exploited in the wild.

How severe is CVE-2026-100383?

Informational severity, published 25 September 2026.

Which products and versions are affected?

Wikimedia Foundation Mediawiki WikiLambda extension 1.47.0-alpha.

Is there a fix for CVE-2026-100383?

A patch was published on 2026-08-17: Fix merged to master branch and deployed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100383 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100383?

Check whether you run Wikimedia Foundation Mediawiki WikiLambda extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100383: Mediawiki WikiLambda extension stored XSS in Visual Editor integration

CVE-2026-100383 · Severity: info · Published 2026-09-25

Mediawiki's WikiLambda extension, which enables wiki pages to call serverless functions, contains a stored cross-site scripting (XSS) vulnerability in its Visual Editor integration. An attacker with interface editing permissions can inject malicious JavaScript into system messages that are executed in the browsers of all users viewing affected pages. This could allow account takeover, session hijacking, or malware distribution to wiki administrators and editors.

Technologies: Wikimedia Foundation Mediawiki WikiLambda extension. Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-100383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100383 being exploited in the wild.
How severe is CVE-2026-100383?: Informational severity, published 25 September 2026.
Which products and versions are affected?: Wikimedia Foundation Mediawiki WikiLambda extension 1.47.0-alpha.
Is there a fix for CVE-2026-100383?: A patch was published on 2026-08-17: Fix merged to master branch and deployed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100383 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100383?: Check whether you run Wikimedia Foundation Mediawiki WikiLambda extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in WikiLambda's Visual Editor integration (ve.ce.WikifunctionsCallNode.js), where the wikilambda-visualeditor-wikifunctionscall-ce-loading message is inserted as raw HTML via OO.ui.msg() instead of as escaped text. An attacker with the editinterface permission can modify MediaWiki interface messages to inject arbitrary HTML/JavaScript payloads that execute when users insert wiki function calls via Visual Editor. The fix converts the message insertion from HTML mode to text mode, ensuring proper escaping.

Affected products

Wikimedia Foundation Mediawiki WikiLambda extension 1.47.0-alpha

Timeline

2026-09-25: disclosed: CVE-2026-100383 published
2026-08-17: patched: Fix merged to master branch and deployed
2026-08-15: other: Vulnerability reported and patch submitted

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.