A flaw was found in the MediaWiki WikiLambda extension. Unsafe string replacements on user-provided HTML in the WikifunctionsFragmentRenderer component allow a remote attacker to conduct stored cross-site scripting (XSS) attacks. By submitting specially crafted input, an attacker can cause arbitrary script code to execute in the context of an unsuspecting user's browser session, potentially compromising accounts or accessing sensitive information.
Last checked: 2026-09-30 22:14 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 18:15 UTC)
Fix evidence last checked: 2026-09-30 04:28 UTC