CVE-2026-22713: MediaWiki GrowthExperiments XSS Flaw

CVE-2026-22713 Overview

CVE-2026-22713 is a Cross-Site Scripting (XSS) vulnerability affecting The Wikimedia Foundation's MediaWiki GrowthExperiments Extension. This vulnerability stems from improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by other users.

The GrowthExperiments extension is designed to help new users contribute to MediaWiki-based wikis, making this vulnerability particularly concerning as it could be leveraged to target inexperienced wiki users who may be less likely to recognize malicious activity.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of authenticated users' browser sessions, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of victims.

Affected Products

• MediaWiki GrowthExperiments Extension version 1.45
• MediaWiki GrowthExperiments Extension version 1.44
• MediaWiki GrowthExperiments Extension version 1.43
• MediaWiki GrowthExperiments Extension version 1.39

Discovery Timeline

• 2026-01-09 - CVE-2026-22713 published to NVD
• 2026-01-09 - Last updated in NVD database

Technical Details for CVE-2026-22713

Vulnerability Analysis

This XSS vulnerability exists due to insufficient input validation and output encoding within the GrowthExperiments Extension for MediaWiki. When user-controlled data is rendered without proper sanitization, it allows attackers to inject malicious scripts that execute in the victim's browser context.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses various types of cross-site scripting attacks. Successful exploitation requires user interaction, as the victim must visit a page containing the malicious payload for the attack to execute.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-supplied input within the GrowthExperiments extension. Specifically, the extension fails to adequately sanitize or encode user input before incorporating it into the generated HTML output. This lack of proper input neutralization allows specially crafted input containing script elements to be interpreted as executable code by the victim's browser.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to craft malicious input that gets stored or reflected through the GrowthExperiments extension. The attack requires some level of preparation and user interaction to be successful.

An attacker would typically:

1. Identify an input field or parameter within the GrowthExperiments extension that does not properly sanitize user input
2. Craft a malicious payload containing JavaScript code
3. Submit the payload through the vulnerable input mechanism
4. Wait for a victim user to view the page containing the injected content
5. The malicious script executes in the victim's browser with their session privileges

The vulnerability mechanism involves insufficient HTML encoding of user-controlled data. When the extension processes and displays content without proper sanitization, script tags or JavaScript event handlers embedded in the input are rendered as executable code. Technical details can be found in the Wikimedia Phabricator Task.

Detection Methods for CVE-2026-22713

Indicators of Compromise

• Unexpected JavaScript execution or browser behavior when viewing pages utilizing the GrowthExperiments extension
• Unusual network requests to external domains originating from wiki pages
• User reports of suspicious pop-ups, redirects, or session anomalies while using GrowthExperiments features
• Web server logs showing requests with encoded script tags or JavaScript event handlers in URL parameters or POST data

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in requests targeting MediaWiki endpoints
• Enable and monitor MediaWiki security logs for suspicious input patterns associated with the GrowthExperiments extension
• Deploy Content Security Policy (CSP) headers to detect and report unauthorized script execution attempts
• Conduct regular security scans of MediaWiki installations using tools that can identify XSS vulnerabilities

Monitoring Recommendations

• Monitor browser console errors and CSP violation reports for script execution anomalies
• Review web server access logs for requests containing potentially malicious characters such as <script>, javascript:, or HTML event handlers
• Set up alerting for unusual session activity that may indicate session hijacking attempts following XSS exploitation
• Implement real-time monitoring of user-generated content for suspicious patterns before rendering

How to Mitigate CVE-2026-22713

Immediate Actions Required

• Update the GrowthExperiments extension to the latest patched version available from the Wikimedia Foundation
• Review and audit any user-generated content that may have been processed through vulnerable extension versions
• Implement strict Content Security Policy (CSP) headers to limit the impact of potential XSS attacks
• Consider temporarily disabling the GrowthExperiments extension until patches can be applied if the extension is not critical to operations

Patch Information

The Wikimedia Foundation has addressed this vulnerability through code changes tracked in their version control system. Administrators should review the Wikimedia Gerrit Change Request for patch details and apply the fix to their MediaWiki installations.

Additional context about this security issue can be found in the Wikimedia Phabricator Task.

Workarounds

• Implement strict Content Security Policy headers with script-src 'self' to prevent inline script execution
• Apply input validation at the server level using MediaWiki's built-in sanitization functions before data is processed by the GrowthExperiments extension
• Deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious input
• Restrict access to GrowthExperiments features to trusted users until the patch is applied

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"