Description
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
Metrics
CVSS 3.1 8.2/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| The Wikimedia Foundation | Mediawiki - CSS Extension | >= 1.39.x, < 1.39.9; >= 1.41.x, < 1.41.3; >= 1.42.x, < 1.42.2 |
| wikimedia | mediawiki-extensions-css | >= 1.39.0, < 1.39.9; >= 1.41.0, < 1.41.3; >= 1.42.0, < 1.42.2 |
References
- https://gerrit.wikimedia.org/r/q/I6f38f4a8fc1dcd690ab27b8f18ce6ca903bacc53Patch
- https://phabricator.wikimedia.org/T368594Exploit, Issue Tracking, Vendor Advisory
- https://phabricator.wikimedia.org/T368628Issue Tracking, Vendor Advisory
Timeline
- Published
- Oct 5, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed