Executive brief
A security vulnerability exists in the Charts extension for MediaWiki, a popular platform used for wikis like Wikipedia. An attacker can create a malicious chart that, when viewed by other users, executes unauthorized code in their browser. This could allow an attacker to steal session information or perform actions on behalf of other users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Charts extension's progressive enhancement path. The root cause is the improper neutralization of input in the pie chart tooltip formatter within 'render.js'. Specifically, malicious titles in numeric fields within 'Data:*.tab' pages are preserved and passed to the client-side ECharts library, which renders the tooltip using 'innerHTML' by default. An attacker with the ability to edit Data pages can inject HTML/JavaScript that executes when a victim hovers over or taps a pie slice. The issue was addressed by switching the tooltip render mode to 'richText', which treats content as plain text rather than executable HTML.
Affected products
- The Wikimedia Foundation Mediawiki - Charts Extension before 1.43.9, 1.44.6, 1.45.4
Timeline
- 2026-06-29: disclosed: Vulnerability reported to Wikimedia security team.
- 2026-07-01: advisory: CVE-2026-14358 published.