Executive brief
MediaWiki, the software powering Wikipedia and many other wikis, is affected by a security vulnerability that could allow malicious scripts to run in a user's browser. This occurs when the system fails to properly clean input before displaying it on certain administrative and logging pages. If exploited, an attacker could potentially perform actions on behalf of other users or access sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in MediaWiki's logging and special page components, specifically within several formatter files including LogFormatter.php and SpecialVersion.php. The issue stems from improper neutralization of input before it is rendered in the web interface. An attacker with low privileges (PR:L) could potentially inject malicious scripts that execute in the context of another user's browser session, provided there is some form of user interaction (UI:A). The vulnerability is addressed in versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9.
Affected products
- Wikimedia Foundation MediaWiki < 1.46.0, < 1.45.4, < 1.44.6, < 1.43.9
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory