# CVE-2026-34094: Wikimedia Foundation MediaWiki JavaScript injection in page protection indicators

Source: https://junglewise.ai/threats/cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-34094 · Severity: low · CVSS 3.8 · Published 2026-05-11

A vulnerability exists in MediaWiki, the software used to power Wikipedia and other collaborative wikis, specifically within its page protection indicator system. This flaw could allow a user with administrative privileges to bypass security restrictions and insert unauthorized JavaScript code into pages. If exploited, this could lead to unauthorized actions being performed in the context of other users' sessions, potentially compromising sensitive administrative functions.

Technologies: [Wikimedia Foundation MediaWiki](https://junglewise.ai/threats/technologies/mediawiki). Vendors: [Wikimedia Foundation](https://junglewise.ai/threats/vendors/wikimedia-foundation).

## Quick answers

**Is CVE-2026-34094 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34094 being exploited in the wild.

**How severe is CVE-2026-34094?** Low severity, with a CVSS score of 3.8, published 11 May 2026.

**Which products and versions are affected?** Wikimedia Foundation MediaWiki before 1.43.7, 1.44.4, 1.45.2.

**Is there a fix for CVE-2026-34094?** A patch was published on 2026-02-15: Security patches developed for release branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34094 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34094?** Check whether you run Wikimedia Foundation MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in MediaWiki's 'includes/Page/Article.php' component arises from a failure to validate the link target for customized help links in page protection indicators. When the '$wgEnableProtectionIndicators' setting is enabled, the software fails to properly prefix or validate the help page link, causing it to be relative to subpage names. This lack of validation allows an attacker with administrative privileges (but lacking 'interface-admin' rights) to inject JavaScript into the page via the 'MediaWiki:Protection-editautoreviewprotected-helppage' message. The issue affects MediaWiki versions prior to 1.43.7, 1.44.4, and 1.45.2. Patches have been released to validate these link targets.

## Affected products

- Wikimedia Foundation MediaWiki before 1.43.7, 1.44.4, 1.45.2

## Timeline

- 2026-02-01: disclosed: Issue reported via Phabricator
- 2026-02-15: patched: Security patches developed for release branches
- 2026-03-25: advisory: Task resolved and CVE assigned
- 2026-05-11: other: NVD publication date

## References

- [https://phabricator.wikimedia.org/T416090](https://phabricator.wikimedia.org/T416090)

## Related threats

- [Mediawiki Wikibase Extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100245-improper-neutralization-of-input-during-web-page-generation-xss)
- [Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles](https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss)
- [MediaWiki Wikibase reflected XSS in Special:SetLabel](https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss)
- [Wikimedia Foundation MediaWiki XSS in Logging and Special Pages](https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages)
- [Wikimedia Foundation MediaWiki Information Exposure in User API](https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api)