CVE-2026-100376: TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wikimedia MediaWiki TemplateSandbox Extensionto a version that resolves this vulnerability.Fixed in 1.46.1 - Upgrade
Upgrade
Wikimedia MediaWiki TemplateSandbox Extensionto a version that resolves this vulnerability.Fixed in 1.45.5 - Upgrade
Upgrade
Wikimedia MediaWiki TemplateSandbox Extensionto a version that resolves this vulnerability.Fixed in 1.43.10
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the MediaWiki TemplateSandbox Extension in versions before 1.46.1, 1.45.5, and 1.43.10. Deployments running one of those older version lines should update to the corresponding fixed release.
What does an attacker need to do to exploit this issue?
The attacker needs to cause another user to preview a page using a particular sandbox prefix. The vulnerability can then result in cross-site scripting in that user's browser.