CVE-2026-58030 Overview
CVE-2026-58030 is a Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation SyntaxHighlight_GeSHi extension for MediaWiki. The flaw stems from improper neutralization of user-controlled input during web page generation within includes/SyntaxHighlight.Php. An authenticated attacker with low privileges can inject script content that executes in the browsers of users viewing affected pages. The issue is categorized under [CWE-79]: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated users can inject JavaScript that executes in the context of other wiki visitors, enabling session theft, defacement, or targeted phishing against wiki communities.
Affected Products
- Wikimedia Foundation SyntaxHighlight_GeSHi versions before 1.46.0
- Wikimedia Foundation SyntaxHighlight_GeSHi 1.45.4 and earlier in the 1.45.x branch
- Wikimedia Foundation SyntaxHighlight_GeSHi 1.44.6 and 1.43.9 branch releases
Discovery Timeline
- 2026-07-01 - CVE-2026-58030 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-58030
Vulnerability Analysis
The SyntaxHighlight_GeSHi extension renders syntax-highlighted code blocks inside MediaWiki pages. The vulnerable logic resides in includes/SyntaxHighlight.Php, where attribute or tag content passed to the highlighter is not fully sanitized before being emitted into the generated HTML. An authenticated editor can craft a page that includes a <syntaxhighlight> block with attacker-controlled content that escapes the intended HTML context.
When a victim later renders the page, the injected payload executes in the victim's browser under the wiki's origin. This grants access to session cookies, CSRF tokens, and any editable content the victim can reach. The attack vector is network-based and requires low privileges but no user interaction beyond viewing the page.
Root Cause
The root cause is missing or insufficient output encoding when the extension serializes highlighter output into MediaWiki page HTML. Special characters such as <, >, and quote delimiters were not consistently escaped for the HTML context in which they were rendered. Fixed releases 1.46.0, 1.45.4, 1.44.6, and 1.43.9 address the neutralization gap in SyntaxHighlight.Php.
Attack Vector
An authenticated user submits an edit containing a crafted <syntaxhighlight> block whose attributes or content include HTML-breaking sequences. The malicious markup is stored in the wiki page. Any subsequent viewer of that page triggers execution of the injected script. Refer to the Wikimedia Task T427167 advisory for technical detail on the vulnerable path.
Detection Methods for CVE-2026-58030
Indicators of Compromise
- Wiki page revisions containing <syntaxhighlight> tags with unusual attribute values, embedded <script> fragments, or event handlers such as onerror and onload
- Outbound requests from user browsers to attacker-controlled domains immediately after loading a wiki page that uses syntax highlighting
- Sudden spikes in failed CSRF token validation or unexpected privileged actions from accounts that recently viewed edited pages
Detection Strategies
- Audit MediaWiki revision history for edits that add or modify <syntaxhighlight> blocks by low-reputation accounts
- Inspect rendered page HTML for script tags or inline event handlers emitted from within highlighter output containers
- Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for inline script executions on pages using syntax highlighting
Monitoring Recommendations
- Enable MediaWiki AbuseFilter rules to flag edits containing script-like tokens inside <syntaxhighlight> regions
- Forward MediaWiki access logs and CSP reports to a centralized logging platform for correlation across sessions
- Alert on account activity that combines page edits with subsequent privileged actions performed by other users viewing those pages
How to Mitigate CVE-2026-58030
Immediate Actions Required
- Upgrade SyntaxHighlight_GeSHi to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on the MediaWiki branch in use
- Review recent edits to pages that use <syntaxhighlight> and revert any suspicious content injected before patching
- Rotate administrative session tokens and audit account permissions for users who viewed potentially malicious pages
Patch Information
Wikimedia Foundation released fixed versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9 of the SyntaxHighlight_GeSHi extension. The patch adds proper neutralization within includes/SyntaxHighlight.Php. Consult the Wikimedia Task T427167 tracking entry for release details and commit references.
Workarounds
- Restrict edit permissions on affected wikis to trusted users until the extension is upgraded
- Enforce a strict Content Security Policy that disallows inline scripts and unsafe event handlers on wiki pages
- Temporarily disable the SyntaxHighlight_GeSHi extension if upgrading is not immediately feasible
# Example: upgrade the extension via composer inside the MediaWiki root
cd /var/www/mediawiki
composer require mediawiki/syntax-highlight-geshi:^1.46.0
php maintenance/update.php --quick
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
