CVE-2026-103046: WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
Published Sep 29, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS.
This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki - WikiLambda Extension<1.46.1
Event History
Sep 29, 2026
CVE Published
via MITRE·10:41 PM
Data Sourced
via MITRE·10:41 PM
DescriptionWeakness
Data Sourced
via NVD·11:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki installations using the WikiLambda extension are affected if the extension version is earlier than 1.46.1.
2
What is the impact if exploited?
The vulnerability allows stored cross-site scripting through improper neutralization of input during web page generation.