Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php.



This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published: 2026-07-01
Score: 0 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of user input during web page generation allows an attacker to inject malicious JavaScript into the pretty‑printed API output when combined with a central authentication token. The flaw is a classic XSS vulnerability that can be triggered by a crafted API request that causes user data to be included in the output without proper encoding, enabling arbitrary code execution in the victim’s browser.

Affected Systems

MediaWiki and CentralAuth components of the Wikimedia Foundation are vulnerable in all releases before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 for both products.

Risk and Exploitability

The EPSS score is < 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a very low probability of exploitation. The CVSS score of 5.4 indicates moderate risk for cross‑site scripting. Attackers would need to craft a specific API request and, potentially, obtain a central authentication token to trigger the flaw.

Generated by OpenCVE AI on August 13, 2026 at 12:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update MediaWiki and CentralAuth to 1.46.0 or later to apply the vendor‑supplied patch.
  • Disable the pretty‑print feature for all API responses by setting $wgEnablePrettyPrint = false in LocalSettings.php until the patch is applied.
  • Restrict untrusted or unauthenticated access to pretty‑printed API endpoints via firewall rules or by enforcing a stricter Content Security Policy that blocks inline script execution on those responses.

Generated by OpenCVE AI on August 13, 2026 at 12:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6380-1 mediawiki security update
References
Link Providers
https://phabricator.wikimedia.org/T422306 cve-icon cve-icon
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia centralauth
Wikimedia mediawiki
Vendors & Products Wikimedia
Wikimedia centralauth
Wikimedia mediawiki

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Title Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 0, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mediawiki Mediawiki
Wikimedia Centralauth Mediawiki
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T15:50:39.761Z

Reserved: 2026-06-27T13:32:37.577Z

Link: CVE-2026-58028

cve-icon Vulnrichment

Updated: 2026-07-01T15:50:36.287Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-01T16:16:50.077

Modified: 2026-07-09T19:37:07.557

Link: CVE-2026-58028

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T12:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')