Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php.



This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published: 2026-07-01
Score: 0 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of user‑supplied input during page generation allows an attacker to inject malicious JavaScript through the pretty‑printed API output when combined with a central authentication token. The flaw is an XSS vulnerability that can act on API requests that cause the output to include user data without proper encoding.

Affected Systems

MediaWiki and CentralAuth from the Wikimedia Foundation are affected.46.0, 1.45.4, 1.44.6, and 1.43.9, and the corresponding CentralAuth releases with the same version thresholds, are vulnerable.

Risk and Exploitability

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a crafted API request that triggers the pretty with the exposure of the affected API endpoints to unauthenticated or low‑privilege users.

Generated by OpenCVE AI on July 21, 2026 at 14:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update MediaWiki and CentralAuth to version 1.46.0 or later to apply the vendor‑supplied XSS fix.
  • Restrict direct access to the pretty‑printed API endpoints for unauthenticated users by configuring firewall rules or enforcing a stricter Content Security Policy that disallows inline script execution or limits script sources for responses that involve the vulnerable API endpoints until the patch is deployed.
  • Disable the pretty‑print feature for all API responses by setting $wgEnablePrettyPrint = false in LocalSettings.php until the patch is applied.

Generated by OpenCVE AI on July 21, 2026 at 14:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6380-1 mediawiki security update
References
Link Providers
https://phabricator.wikimedia.org/T422306 cve-icon
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia centralauth
Wikimedia mediawiki
Vendors & Products Wikimedia
Wikimedia centralauth
Wikimedia mediawiki

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Title Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 0, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wikimedia Centralauth Mediawiki
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T15:50:39.761Z

Reserved: 2026-06-27T13:32:37.577Z

Link: CVE-2026-58028

cve-icon Vulnrichment

Updated: 2026-07-01T15:50:36.287Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')