CVE-2026-22712: MediaWiki ApprovedRevs Extension XSS Flaw

CVE-2026-22712 Overview

CVE-2026-22712 is an Improper Encoding or Escaping of Output vulnerability (CWE-116) affecting The Wikimedia Foundation's MediaWiki ApprovedRevs Extension. The vulnerability stems from improper handling of magic word replacement within the ParserAfterTidy hook, which allows attackers to perform Input Data Manipulation attacks against affected MediaWiki installations.

The ApprovedRevs extension provides functionality for designating specific revisions of wiki pages as "approved," displaying those versions to readers while editors continue working on newer drafts. The vulnerability occurs during the parsing phase when magic words are processed, allowing malicious input to bypass proper encoding mechanisms.

Critical Impact

Attackers can manipulate input data through improper encoding in the ParserAfterTidy hook, potentially affecting content integrity on MediaWiki sites using the ApprovedRevs extension.

Affected Products

• MediaWiki - ApprovedRevs Extension version 1.45
• MediaWiki - ApprovedRevs Extension version 1.44
• MediaWiki - ApprovedRevs Extension version 1.43
• MediaWiki - ApprovedRevs Extension version 1.39

Discovery Timeline

• January 9, 2026 - CVE-2026-22712 published to NVD
• January 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22712

Vulnerability Analysis

This vulnerability is classified as CWE-116: Improper Encoding or Escaping of Output. The issue resides in how the ApprovedRevs extension handles magic word replacement during the ParserAfterTidy hook execution phase.

In MediaWiki's architecture, the ParserAfterTidy hook is invoked after the HTML has been tidied and just before it is added to the parser cache. The ApprovedRevs extension uses this hook to process and replace magic words with appropriate content. However, the implementation fails to properly encode or escape output during this replacement process, creating an opportunity for input data manipulation.

The network-accessible attack vector requires some user interaction, limiting the immediate exploitability. However, the vulnerability can affect confidentiality, integrity, and availability at a limited scope on both the vulnerable system and potentially connected systems.

Root Cause

The root cause lies in the magic word replacement logic within the ParserAfterTidy hook handler. When processing magic words like {{APPROVALYEAR}} or similar ApprovedRevs-specific parser functions, the extension fails to properly sanitize or encode the output before inserting it into the parsed HTML content.

This improper encoding allows specially crafted input to pass through the parsing pipeline without appropriate escaping, enabling attackers to manipulate how data is interpreted or displayed. The vulnerability is a direct result of trusting user-controlled input during the output generation phase without applying proper encoding transformations.

Attack Vector

The attack vector is network-based, meaning exploitation can occur remotely over the network. The attack requires:

1. A MediaWiki installation with the vulnerable ApprovedRevs extension enabled
2. The ability to create or edit wiki content (depending on wiki permissions)
3. User interaction with the manipulated content

An attacker would craft malicious wiki content containing specially formed magic words or parser constructs that exploit the improper encoding during the ParserAfterTidy phase. When the content is processed and rendered, the lack of proper output encoding allows the attacker's manipulated data to be interpreted in unintended ways.

The vulnerability mechanism involves the parser hook processing flow where magic word tokens are replaced with their computed values. Due to missing output encoding, the replacement values can contain characters or sequences that alter the interpretation of surrounding content.

Detection Methods for CVE-2026-22712

Indicators of Compromise

• Unusual or unexpected content appearing on wiki pages that use ApprovedRevs functionality
• Parser cache entries containing anomalous magic word replacement patterns
• Web server logs showing requests with suspicious magic word constructs in page content
• Modified wiki content that does not match editor revision history

Detection Strategies

• Monitor MediaWiki application logs for parsing errors or unexpected behavior in the ParserAfterTidy hook
• Implement content integrity checks for pages managed by the ApprovedRevs extension
• Review recent edits to pages using approval workflows for suspicious magic word usage
• Deploy web application firewall rules to detect input manipulation attempts targeting MediaWiki parser functions

Monitoring Recommendations

• Enable verbose logging for the ApprovedRevs extension to capture magic word processing events
• Implement file integrity monitoring on MediaWiki extension directories
• Configure alerts for unusual patterns in wiki page rendering or caching behavior
• Regularly audit ApprovedRevs-managed content for unauthorized modifications

How to Mitigate CVE-2026-22712

Immediate Actions Required

• Review the Wikimedia Phabricator Task for official guidance and patch availability
• Assess which MediaWiki installations are using the affected ApprovedRevs extension versions (1.39, 1.43, 1.44, 1.45)
• Consider temporarily disabling the ApprovedRevs extension on public-facing wikis until a patch is applied
• Restrict page editing permissions to trusted users on wikis where ApprovedRevs cannot be disabled

Patch Information

The Wikimedia Foundation has addressed this vulnerability through a code change tracked in the Wikimedia Gerrit Change Review. Administrators should review this change and update their ApprovedRevs extension to a patched version when available.

To update the ApprovedRevs extension:

1. Access the Wikimedia Gerrit Change Review for the specific patch
2. Follow MediaWiki extension update procedures for your deployment method
3. Clear the parser cache after updating to ensure the fix takes effect
4. Verify the update by checking the extension version in Special:Version

Workarounds

• Disable the ApprovedRevs extension temporarily if the functionality is not critical to operations
• Implement strict content security policies to limit the impact of potential input manipulation
• Restrict wiki editing to authenticated and trusted users only
• Enable additional input validation at the web server or reverse proxy level
• Monitor the Wikimedia Phabricator Task for updated mitigation guidance

# Example: Temporarily disable ApprovedRevs in LocalSettings.php
# Comment out or remove the extension loading line:
# wfLoadExtension( 'ApprovedRevs' );

# After patching, clear the parser cache:
php maintenance/run.php rebuildFileCache