CVE-2026-100383
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks.
Recommendation
It is recommended to update the WikiLambda extension to a version from the master branch that includes the fix.
Other vulnerabilities in MediaWiki WikiLambda Extension
See all- CVE-2026-103046Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
- CVE-2026-100377Medium
Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.
- CVE-2026-96872Low
The WikiLambda extension for MediaWiki before version 1.47.0 has improper handling of insufficient permissions, allowing access to functionality not properly constrained by ACLs. The issue affects Linux, MacOS, and Windows.
- CVE-2026-58517Medium
A vulnerability in the WikiLambda extension for MediaWiki allows authentication bypass due to improper neutralization of input terminators. Affects versions before 1.43.9, 1.44.6, and 1.45.4.
- CVE-2025-62695Medium
The WikiLambda extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects the master version.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS