The Wikimedia Foundation Mediawiki - WikiLambda Extension vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting The Wikimedia Foundation Mediawiki - WikiLambda Extension: 7 record(s), with affected versions and fixes.
CVE-2026-103446
High · 7.4
Public exploit CWE-639 Sep 30, 2026
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.
This issue affects MediaWiki WikiLambda extension: 1.46.
CVE-2026-103046
Medium · 6.1
CWE-79 Sep 29, 2026
WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS.
This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
CVE-2026-100383
Medium · 4.8
CWE-79 Sep 25, 2026
Stored i18n XSS in WikiLambda's VisualEditor integration
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
CVE-2026-100377
Medium · 6.9
CWE-200 Sep 25, 2026
Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation.
This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
CVE-2026-96872
Low · 2.9
CWE-280 Sep 23, 2026
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
CVE-2026-58517
Medium · 4.3
CWE-288 Jul 1, 2026
Blocked users can create and edit WikiLambda objects
Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.
This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.
CVE-2025-62695
Medium · 6.9
CWE-79 Oct 21, 2025
Stored XSS through system messages
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.