Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension

CVE-2026-100383

What is CVE-2026-100383?

The Mediawiki - WikiLambda Extension for Wikimedia Foundation is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw allows attackers to inject malicious scripts, which can lead to unauthorized actions and data theft when users interact with affected pages. The issue was found in version 1.47.0-alpha, but remediation efforts have been implemented in the master branch to mitigate potential risks. Security measures are recommended for users operating this extension.

References