CVE-2026-103050 in MediaWiki
Summary
by MITRE • 09/30/2026
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS.
This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a critical security flaw within the MediaWiki MassMessage extension, specifically categorized as an improper neutralization of input during web page generation, commonly known as cross-site scripting or XSS. This particular instance is classified as stored persistent cross-site scripting because the malicious payload is not merely executed in real-time through user interaction but is instead saved to the server-side database for future retrieval and display. The vulnerability exists prior to version 1.46.1 of the MassMessage extension, affecting versions such as 1.45.5 and 1.43.10. In these affected releases, the application fails to adequately sanitize or encode user-supplied input before it is rendered in HTML contexts within the mass messaging interface. This lack of proper output encoding allows an attacker to inject executable scripts that will be served to any victim who views the compromised content.
From a technical perspective, the flaw stems from insufficient validation and sanitization mechanisms when handling data intended for broadcast messages or related administrative interfaces managed by the MassMessage extension. When a user with appropriate permissions inputs text into fields designed for message composition, the system stores this input without applying necessary HTML entity encoding or context-aware escaping. Consequently, if an attacker crafts a payload containing JavaScript code disguised as legitimate content, that code becomes part of the stored data structure. Upon subsequent rendering by MediaWiki to display the mass message list or details, the browser interprets and executes the embedded script within the victim's session context. This behavior aligns with CWE-79, which defines improper neutralization of input during web page generation as a category where applications fail to prevent cross-site scripting attacks through inadequate sanitization of user inputs before inclusion in dynamic content.
The operational impact of this vulnerability is severe due to its persistent nature and the high privilege level often associated with users who can utilize mass messaging features on Wikimedia projects. Attackers leveraging stored XSS do not need to trick victims into clicking a specially crafted link, as seen in reflected XSS scenarios; instead, the malicious script executes automatically whenever an authorized user accesses the affected page. This facilitates session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users and gain unauthorized access to administrative functions. It also enables defacement of wiki pages by injecting scripts that modify content upon load, phishing attacks designed to harvest credentials from unsuspecting administrators, and potentially keylogging activities if the script captures keystrokes within sensitive forms. The widespread visibility of mass message interfaces means a single successful exploitation can impact numerous users across different wikis hosted on Wikimedia infrastructure.
This vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution in web browsers, and specifically relates to the persistence tactic where malicious code is stored for later activation. The ability to execute arbitrary scripts within the context of a trusted domain allows attackers to bypass same-origin policies that typically restrict cross-domain data access. Furthermore, because MassMessage often interacts with user groups and permissions systems, successful exploitation could lead to privilege escalation if the injected script performs actions on behalf of the victim using their elevated rights. This creates a significant risk vector for compromising not just individual accounts but potentially entire wiki communities by manipulating trusted communication channels used for announcements or coordination among editors and administrators.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Administrators operating affected instances should upgrade the MassMessage extension to version 1.46.1 or later, where this input handling flaw has been addressed through improved sanitization routines. Until patches are applied, temporary mitigations include restricting access to mass messaging features exclusively to a minimal set of highly trusted users and implementing strict Content Security Policy headers that restrict script execution sources if feasible within the deployment environment. Additionally, deploying Web Application Firewalls with rules capable of detecting and blocking common XSS payloads in POST requests can provide an additional layer of defense against exploitation attempts. Regular security audits focusing on input validation across all user-facing forms are essential to prevent similar vulnerabilities from being introduced or overlooked in future updates.