CVE-2026-103585: attacker-controlled javascript license URL via XSS
Published Sep 30, 2026
·Updated
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki MediaSearch extension=1.46, =1.45, =1.43
Event History
Sep 30, 2026
CVE Published
via MITRE·10:17 PM
Data Sourced
via MITRE·10:17 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Oct 1, 2026
Exploit Published
via GitHub·01:06 AM
Frequently Asked Questions
1
Which MediaSearch versions are affected?
The issue affects the MediaWiki MediaSearch extension versions 1.46, 1.45, and 1.43.
2
What access and interaction are required for exploitation?
The CVSS vector indicates network-reachable exploitation with low attack complexity, but requires low privileges and user interaction. The vector also indicates an additional attacker precondition.
3
What is the potential impact if exploitation succeeds?
Successful exploitation can have low impact on confidentiality, integrity, and availability for both the vulnerable system and subsequent systems, according to the CVSS vector.