CVE-2026-100376 in MediaWiki
Summary
by MITRE • 09/25/2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified as Improper Neutralization of Input During Web Page Generation represents a critical security flaw within the Wikimedia Foundation's MediaWiki platform, specifically affecting the TemplateSandbox extension. This class of issue is formally categorized under CWE-79 in the Common Weakness Enumeration standard and corresponds to Cross-Site Scripting (XSS) attacks as defined by industry frameworks such as MITRE ATT&CK technique T1059. The flaw arises from a failure in the input validation and output encoding mechanisms inherent to how the TemplateSandbox extension processes user-supplied data before rendering it within web pages. When an application fails to properly neutralize special characters or script tags contained within user inputs, malicious actors can inject client-side scripts that execute in the context of other users' browsers.
The technical root cause lies in the specific handling of template parameters and sandboxed environments within MediaWiki versions prior to 1.46.1, 1.45.5, and 1.43.10. The TemplateSandbox extension is designed to allow users to test templates safely without affecting live wiki pages. However, in the affected versions, the sanitization logic does not adequately strip or encode potentially dangerous content when rendering these sandboxed templates for preview purposes. This oversight allows an attacker who can influence template input parameters to inject executable JavaScript code. Because this execution occurs within the trusted domain of the MediaWiki instance, the browser grants the injected script full access to cookies, session tokens, and other sensitive data associated with that domain due to same-origin policy rules.
The operational impact of this vulnerability is severe for both individual users and the broader Wikimedia ecosystem. Successful exploitation enables an attacker to perform actions such as stealing user authentication credentials by exfiltrating session cookies, hijacking active sessions to impersonate legitimate users, or performing unauthorized administrative actions if the victim has elevated privileges. Furthermore, attackers can deface wiki pages, redirect users to malicious phishing sites, or use the compromised browser environment to launch further attacks against internal network resources if the user is connected via a corporate or institutional VPN. The persistence of this vulnerability across multiple major release branches indicates a systemic issue in how template rendering logic was implemented and maintained during that period, potentially affecting thousands of wiki instances globally.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators operating MediaWiki installations with the TemplateSandbox extension are strongly advised to upgrade to version 1.46.1 or later for stable releases, or equivalent patched versions in other supported branches such as 1.45.5 and 1.43.10. These updates contain specific patches that correct the input neutralization logic within the sandbox rendering process. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations include disabling the TemplateSandbox extension entirely if it is not strictly required for daily operations. Additionally, implementing a Web Application Firewall with robust XSS detection rules can help filter out malicious payloads before they reach the application layer, although this should be viewed as a compensatory control rather than a definitive fix. Regular security audits and code reviews focusing on input validation practices are also recommended to prevent similar vulnerabilities in future development cycles.