A flaw was found in the MediaWiki TemplateSandbox extension. A remote attacker could exploit this vulnerability by enticing a victim into previewing a page configured with a specially crafted sandbox prefix. This flaw can lead to Cross-Site Scripting (XSS), enabling the execution of arbitrary script code within the victim's browser session and potentially compromising their account or session information.
Last checked: 2026-10-22 16:23 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-26 22:42 UTC)
Fix evidence last checked: 2026-09-29 08:29 UTC