Threats affecting pkg:github/wikimedia/extensions/WikiLambda

A Cross-Site Scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki WikiLambda Extension version 1.47.0-alpha. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue has been fixed in the master branch of the codebase.

CVE-2026-100377 is a medium-severity vulnerability in the Wikimedia Foundation's Mediawiki WikiLambda Extension version 1.47.0-alpha. It involves exposure of sensitive information to unauthorized actors. The issue has been fixed in the master branch of the codebase. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network-exploitable flaw with low complexity and no required privileges or user interaction.

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.