Executive brief
The Score extension for MediaWiki, which allows users to render musical notation, contains a security flaw that could allow an attacker to execute malicious scripts in another user's browser. By crafting a page with specific musical score data, an attacker can inject code that triggers when a visitor interacts with the rendered score or its associated popups. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Score extension due to the improper neutralization of input in the 'ext.score.popup' module. The extension stores URLs (such as MIDI and source links) in non-reserved HTML data attributes (data-midi, data-source) and subsequently uses them as href attributes for links in a popup window without sufficient sanitization. An attacker can exploit this by injecting 'javascript:' URIs into these attributes, which are then executed when a user clicks the links within the score's popup interface. The vulnerability was remediated by switching to reserved 'data-mw-' attributes and improving sanitization in the master branch and release branches 1.43, 1.44, and 1.45.
Affected products
- The Wikimedia Foundation MediaWiki - Score Extension < 1.43, < 1.44, < 1.45
Timeline
- 2026-03-06: disclosed: Vulnerability reported and task created in Phabricator.
- 2026-03-09: patched: Security patch deployed to production.
- 2026-04-07: advisory: CVE-2026-39936 published.