Executive brief
MediaWiki and its CentralAuth extension are used to power collaborative websites like Wikipedia. A security vulnerability has been identified where the software fails to properly sanitize user input before displaying it on a web page. This could allow an attacker to inject malicious scripts, potentially leading to unauthorized actions or data theft within a user's browser session.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in MediaWiki and the CentralAuth extension due to improper neutralization of input during web page generation. The flaw is located across several components including API formatting, help modules, and log formatters (specifically in ApiFormatBase.php, ApiHelp.php, Module.php, PageDisplayHookHandler.php, and PermissionChangeLogFormatter.php). An attacker with low privileges could potentially exploit this via the network to execute arbitrary scripts in the context of a user's browser. While the vendor has assigned a CVSS score of 0.0, the vulnerability is categorized as CWE-79. Patches are available in versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9.
Affected products
- Wikimedia Foundation MediaWiki < 1.46.0, < 1.45.4, < 1.44.6, < 1.43.9
- Wikimedia Foundation CentralAuth < 1.46.0, < 1.45.4, < 1.44.6, < 1.43.9
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory