CVE-2026-103443 in MediaWiki Collection
Summary
by MITRE • 09/30/2026
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements.
This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a classic Cross-Site Scripting flaw within the Wikimedia Foundation's MediaWiki Book extension, specifically affecting versions 1.46, 1.45, and 1.43. This security issue stems from an improper neutralization of script-related HTML tags when user-supplied input is rendered in web pages without adequate sanitization or encoding. Unlike more complex XSS vectors that require specific event handlers or JavaScript contexts, this vulnerability allows for the injection of malicious scripts targeting non-script elements within the Document Object Model. The core technical flaw lies in the extension's failure to properly escape special characters such as angle brackets and quotes when processing input intended for display, thereby allowing an attacker to inject executable code directly into the page structure where it can be interpreted by the victim's browser.
From a technical perspective, this vulnerability is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of this flaw involves targeting non-script elements, meaning that an attacker does not need to inject code into a script tag or event attribute like onclick. Instead, the malicious payload can be embedded in standard HTML tags such as divs, spans, or paragraphs if those tags are rendered with unescaped content. This broadens the attack surface significantly because many web applications sanitize input for script contexts but may overlook strict escaping requirements for general text rendering contexts within dynamic extensions. The MediaWiki Book extension likely constructs output strings by concatenating user inputs directly into HTML structures without applying context-aware encoding, which is a fundamental violation of secure coding practices recommended in OWASP guidelines.
The operational impact of this vulnerability is severe due to the nature of Wikimedia platforms and their extensive user base. An attacker who exploits this flaw can execute arbitrary JavaScript code in the context of the victim's browser session. This capability enables several malicious activities including session hijacking, where the attacker steals authentication cookies or tokens to impersonate legitimate users; credential harvesting by injecting fake login forms that capture usernames and passwords; and defacement of wiki pages by altering displayed content. Furthermore, because MediaWiki is often used for collaborative knowledge bases containing sensitive information in certain contexts, an XSS attack could lead to data exfiltration or the distribution of malware through drive-by downloads if combined with other vulnerabilities. The trust associated with Wikimedia domains also increases the likelihood that users will interact with malicious links shared within these environments, amplifying the potential reach and success rate of such attacks.
Mitigation strategies must focus on immediate remediation at both the application code level and infrastructure layer. For administrators running affected versions 1.43 through 1.46, the primary action is to upgrade the MediaWiki Book extension to a patched version where input validation and output encoding have been rigorously implemented. If upgrading is not immediately feasible, temporary mitigations should include implementing strict Content Security Policy headers that restrict script execution sources and disable inline scripts using nonce-based or hash-based policies. Additionally, web application firewalls can be configured with rules specifically targeting XSS patterns in query parameters and POST bodies associated with the Book extension endpoints to block exploitation attempts at the network perimeter. Long-term resolution requires adopting a defense-in-depth approach where all user inputs are treated as untrusted data until explicitly validated against allowlists of safe characters for their specific context, ensuring that HTML entities are properly encoded before being rendered in any part of the page structure regardless of whether they appear within script or non-script elements.