CVE-2026-0670

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0670", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-07T16:35:04.806Z", "datePublished": "2026-01-07T18:55:42.559Z", "dateUpdated": "2026-01-07T19:25:36.796Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MediaWiki - ProofreadPage Extension", "repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/ProofreadPage", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).<p>This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-07T18:55:42.559Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T409423"}, {"url": "https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS through a system message and a user-provided parameter in ProofreadPage", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T19:24:45.370321Z", "id": "CVE-2026-0670", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T19:25:36.796Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0670", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T19:24:45.370321Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T19:25:08.156Z"}}], "cna": {"title": "Stored XSS through a system message and a user-provided parameter in ProofreadPage", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/ProofreadPage", "vendor": "Wikimedia Foundation", "product": "MediaWiki - ProofreadPage Extension", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T409423"}, {"url": "https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).<p>This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-07T18:55:42.559Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0670", "state": "PUBLISHED", "dateUpdated": "2026-01-07T19:25:36.796Z", "dateReserved": "2026-01-07T16:35:04.806Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-01-07T18:55:42.559Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaWiki - ProofreadPage Extension", "repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/ProofreadPage", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikisource:proofread_page:1.39:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "F0DC7E84-26A6-4225-AB94-EE6124C11CC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikisource:proofread_page:1.43:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "637AC797-C33D-4328-A8CD-C1E67F68457F", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikisource:proofread_page:1.44:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "C05208D8-F063-424A-933A-37D5357A68C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikisource:proofread_page:1.45:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "7FA36D49-EE20-4805-85FE-820E37BC473E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Neutralizaci\u00f3n Inadecuada de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web (XSS o \u2019cross-site scripting\u2019) vulnerabilidad en Wikimedia Foundation MediaWiki - extensi\u00f3n ProofreadPage permite cross-site scripting (XSS). Este problema afecta a MediaWiki - extensi\u00f3n ProofreadPage: 1.45, 1.44, 1.43, 1.39."}], "id": "CVE-2026-0670", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0670", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T19:24:45.370321Z", "version": "2.0.3"}}]}, "published": "2026-01-07T19:15:56.203", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T409423"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:58:53.568762+00:00", "value": {"mitigation_remediation": ["Upgrade ProofreadPage to the latest version that contains the fix for this stored XSS issue", "Restrict editing of system messages to highly trusted users or administrators, and enforce code reviews for changes", "Sanitize and escape any user\u2011provided parameters before incorporating them into system messages to prevent script injection", "Implement a Content\u2011Security\u2011Policy header that disallows inline scripts and limits executable JavaScript to approved sources"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting via system messages that can compromise users\u2019 confidentiality and integrity in MediaWiki ProofreadPage"}, "threat_synthesis": {"affected_systems": "MediaWiki ProofreadPage Extension versions 1.39, 1.43, 1.44, and 1.45 from the Wikimedia Foundation are affected. Any installation of these extensions that allows the creation or modification of system messages is potentially vulnerable.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw that occurs when a system message incorporates a user\u2011provided parameter without proper escaping. An attacker can inject malicious scripts that will be executed in the context of any user who views the affected page, potentially allowing data theft, session hijacking, or defacement of the site. The weakness is identified as CWE\u201179, representing an improper neutralization of input during web page generation.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. EPSS is reported as less than 1\u202f%, reflecting a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is an attacker who has the ability to create or edit system messages. Once injected, the malicious payload will be stored and served to all users, making it a potentially widespread threat within the affected installation."}}}}, "created": "2026-01-08T09:48:23.199363+00:00", "updated": "2026-04-18T08:00:05.799147+00:00", "vendors": ["mediawiki", "mediawiki$PRODUCT$mediawiki", "wikimedia", "wikimedia$PRODUCT$mediawiki-proofreadpage_extension"]}