CVE-2026-100382: Unauthenticated remote code execution through wikitext in ExternalData
Published Sep 25, 2026
·Updated
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection.
This issue affects Mediawiki - ExternalData Extension: from before 3.7.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki ExternalData Extension<3.7
Event History
Sep 25, 2026
CVE Published
via MITRE·09:04 PM
Data Sourced
via MITRE·09:04 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki installations using the ExternalData Extension are affected if the extension version is before 3.7.
2
Does exploitation require authentication?
No. The issue is described as unauthenticated remote code execution through wikitext, so an attacker does not need to authenticate to exploit it.