CVE-2026-100383 describes an XSS vulnerability in the Mediawiki WikiLambda Extension version 1.47.0-alpha. The vulnerability arises from improper input neutralization during web page generation, enabling cross-site scripting attacks. The Wikimedia Foundation has remediated this issue in the master branch, indicating that a patch or fix is available. The CVSS 4.0 base score is 4.8 (medium severity), with network attack vector, low complexity, and requiring user interaction and high privileges.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Mediawiki WikiLambda Extension, potentially leading to session hijacking, defacement, or other script-based attacks. However, the vulnerability requires high privileges and user interaction, limiting its impact scope. There are no known exploits in the wild at this time.

A patch is available as the issue has been remediated in the master branch of the WikiLambda Extension. Users should update from version 1.47.0-alpha to the fixed version in the master branch or subsequent releases containing the fix. Since this is a cloud-hosted service, the Wikimedia Foundation manages remediation for the hosted environment; users should verify that their deployments are updated accordingly.