Executive brief
The GlobalWatchlist extension for MediaWiki, which allows users to track changes across multiple wiki sites, contains multiple security flaws that allow for cross-site scripting (XSS). An attacker could exploit these vulnerabilities to run malicious scripts in the browsers of other users, potentially leading to unauthorized actions or the theft of sensitive session information. This issue is particularly relevant for wiki administrators and users who manage content across different platforms.
Technical details
The GlobalWatchlist extension for MediaWiki contains multiple cross-site scripting (XSS) vulnerabilities, including stored and self-XSS. The root cause is the improper neutralization of input during web page generation within components such as the Page Menu, Settings, and various system messages (i18n). Specifically, the extension fails to validate site lists when CentralAuth is disabled and lacks sufficient escaping for usernames and API error messages. An attacker can exploit these by injecting malicious scripts into user-defined site lists or system messages, which are then executed in the context of a victim's browser. The issue has been remediated in the master branch and release branches for MediaWiki versions 1.43, 1.44, and 1.45.
Affected products
- The Wikimedia Foundation MediaWiki - GlobalWatchlist Extension < 1.43, 1.44, 1.45
Timeline
- 2026-02-23: disclosed: Initial report and patch creation in Phabricator.
- 2026-04-07: advisory: CVE published and NVD record created.
- 2026-04-08: patched: Remediation confirmed in release branches.