CVE-2026-58037: MediaWiki XSS Vulnerability

CVE-2026-58037 Overview

CVE-2026-58037 is a Cross-Site Scripting (XSS) vulnerability affecting Wikimedia Foundation MediaWiki. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). It resides in multiple PHP components handling language rendering, log formatting, and version display, allowing authenticated attackers with low privileges to inject script content executed in the browsers of users interacting with affected pages.

The issue impacts MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Exploitation requires user interaction and low-privileged access to the target instance.

Critical Impact

Authenticated attackers can inject malicious script content that executes in the context of other MediaWiki users, enabling session theft, defacement, and privileged action abuse on wiki platforms.

Affected Products

• MediaWiki versions before 1.43.9
• MediaWiki 1.44.x before 1.44.6 and 1.45.x before 1.45.4
• MediaWiki 1.46.x before 1.46.0

Discovery Timeline

• 2026-07-01 - CVE-2026-58037 published to NVD
• 2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58037

Vulnerability Analysis

The vulnerability stems from insufficient output encoding across multiple MediaWiki subsystems responsible for rendering user-controlled or log-derived content. Affected files include includes/Language/Language.php, includes/Logging/BlockLogFormatter.php, includes/Logging/LogFormatter.php, includes/Logging/PatrolLogFormatter.php, includes/Logging/RenameuserLogFormatter.php, includes/Logging/TagLogFormatter.php, and includes/Specials/SpecialVersion.php.

Because the flaw touches log formatters and the Special:Version page, injected payloads can surface in administrative views. This increases the likelihood that privileged users trigger the payload while performing routine moderation or maintenance tasks.

Root Cause

The root cause is improper neutralization of input during web page generation. Fields processed by the language and log formatting layers are rendered into HTML without consistent contextual escaping. When an attacker submits crafted content through actions that generate log entries or language-formatted output, the payload persists and is later served without sanitization.

Attack Vector

Exploitation occurs over the network against MediaWiki instances that permit account creation or low-privilege actions such as edits, block reasons, tag manipulation, or rename operations. The attacker performs an action that generates a log or language-formatted entry containing malicious script content. When a subsequent user views the affected page, such as a log feed or Special:Version, the script executes in their browser session.

See the Wikimedia Task T422995 advisory for the technical breakdown of the affected code paths.

Detection Methods for CVE-2026-58037

Indicators of Compromise

• Log entries or usernames containing HTML tags, javascript: URIs, or encoded script payloads such as <script>.
• Unexpected outbound HTTP requests originating from browser sessions of MediaWiki administrators viewing log pages.
• Modifications to user preferences, permissions, or content authored by administrator accounts without corresponding authentic activity.

Detection Strategies

• Audit MediaWiki database tables backing logging, user, and page for entries containing HTML control characters or script syntax.
• Deploy Content Security Policy (CSP) reporting to capture inline script violations occurring on log and Special pages.
• Correlate web server access logs for anomalous requests to Special:Log, Special:Version, and rename or block action endpoints.

Monitoring Recommendations

• Monitor MediaWiki version strings served by public wikis and inventory instances against the fixed release list.
• Alert on administrative account activity that follows browsing of user-generated log content within a short interval.
• Track failed CSP directives from browsers accessing MediaWiki hosts to identify injection attempts in progress.

How to Mitigate CVE-2026-58037

Immediate Actions Required

• Upgrade to MediaWiki 1.46.0, 1.45.4, 1.44.6, or 1.43.9 based on the branch currently deployed.
• Review recent log, block, tag, and rename entries for embedded HTML or script content and sanitize identified records.
• Rotate session tokens and audit administrator accounts that may have viewed malicious log entries prior to patching.

Patch Information

Wikimedia Foundation released fixed builds in MediaWiki 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Patch details and the affected file list are documented in Wikimedia Task T422995. Apply the release matching your current branch to preserve extension compatibility.

Workarounds

• Enforce a strict Content Security Policy that disallows inline script execution on MediaWiki responses.
• Restrict account creation and edit privileges to trusted users until patches are applied.
• Temporarily disable public visibility of log-related Special pages where feasible until the upgrade completes.

# Configuration example: enforce CSP header in LocalSettings.php
$wgCSPHeader = [
    'default-src' => ["'self'"],
    'script-src'  => ["'self'"],
    'object-src'  => ["'none'"],
    'report-uri'  => '/csp-report-endpoint',
];