CVE-2026-100377
MediumCVSS 6.9Summary
Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.
Risk Assessment
Risk of unauthorized access to sensitive data processed by the WikiLambda extension, potentially leading to information leakage.
Recommendation
It is recommended to update the WikiLambda extension to a version containing the fix from the master branch or apply the appropriate patch.
Other vulnerabilities in Mediawiki WikiLambda Extension
See all- CVE-2026-100383Medium
The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.
- CVE-2026-96872Low
The WikiLambda extension for MediaWiki before version 1.47.0 has improper handling of insufficient permissions, allowing access to functionality not properly constrained by ACLs. The issue affects Linux, MacOS, and Windows.
- CVE-2026-58517Medium
A vulnerability in the WikiLambda extension for MediaWiki allows authentication bypass due to improper neutralization of input terminators. Affects versions before 1.43.9, 1.44.6, and 1.45.4.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS