CVE-2026-22712

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22712", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-08T23:23:42.385Z", "datePublished": "2026-01-09T00:06:22.430Z", "dateUpdated": "2026-01-09T19:15:28.083Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - ApprovedRevs Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Encoding or Escaping of Output&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">due to magic word replacement in ParserAfterTidy</span> vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.<p>This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.</p>"}], "value": "Improper Encoding or Escaping of Output\u00a0due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-09T00:06:22.430Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T412068"}, {"url": "https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a"}], "source": {"discovery": "UNKNOWN"}, "title": "ApprovedRevs allows bypassing the inline CSS sanitizer", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"references": [{"url": "https://phabricator.wikimedia.org/T412068", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T19:15:14.724928Z", "id": "CVE-2026-22712", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:15:28.083Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22712", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T19:15:14.724928Z"}}}], "references": [{"url": "https://phabricator.wikimedia.org/T412068", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:15:25.619Z"}}], "cna": {"title": "ApprovedRevs allows bypassing the inline CSS sanitizer", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - ApprovedRevs Extension", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T412068"}, {"url": "https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Encoding or Escaping of Output\u00a0due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.", "supportingMedia": [{"type": "text/html", "value": "Improper Encoding or Escaping of Output&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">due to magic word replacement in ParserAfterTidy</span> vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.<p>This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-09T00:06:22.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22712", "state": "PUBLISHED", "dateUpdated": "2026-01-09T19:15:28.083Z", "dateReserved": "2026-01-08T23:23:42.385Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-01-09T00:06:22.430Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mediawiki - ApprovedRevs Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.39:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "0680AAB5-C5C7-42A3-9CB3-D99E0126955B", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.43:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "293B8B8B-6988-4E0A-AC72-B49D7C98C050", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.44:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "30B9A0EC-4B7F-4B53-B073-B18291ECB4F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.45:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "73ADBE38-7AFF-4A77-8294-5786ABC4C852", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Encoding or Escaping of Output\u00a0due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Codificaci\u00f3n o escape incorrectos de la salida debido al reemplazo de palabra m\u00e1gica en la vulnerabilidad ParserAfterTidy en la Extensi\u00f3n ApprovedRevs de Mediawiki de la Fundaci\u00f3n Wikimedia permite la manipulaci\u00f3n de datos de entrada. Este problema afecta a la Extensi\u00f3n ApprovedRevs de Mediawiki: 1.45, 1.44, 1.43, 1.39."}], "id": "CVE-2026-22712", "lastModified": "2026-06-17T10:20:16.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22712", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T19:15:14.724928Z", "version": "2.0.3"}}]}, "published": "2026-01-09T00:15:45.837", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T412068"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T412068"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:28:45.512063+00:00", "value": {"mitigation_remediation": ["Upgrade to a fixed version of the ApprovedRevs extension that addresses the magic word replacement bug.", "If an immediate upgrade is not possible, temporarily disable magic word usage in the MediaWiki configuration to prevent the injection vectors.", "Audit existing approved pages for unexpected inline CSS and remove or sanitize any malicious styles discovered.", "Implement stricter content sanitization for inline styles in MediaWiki to mitigate similar issues in the future."], "summary": {"action": "Patch", "impact": "Bypass of inline CSS sanitizer enabling arbitrary CSS injection and potential XSS or content tampering."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ApprovedRevs extension of MediaWiki produced by The Wikimedia Foundation. Versions 1.39, 1.43, 1.44, and 1.45 are vulnerable.", "description_and_impact": "Improper encoding through magic word replacement in the ParserAfterTidy step of the ApprovedRevs extension allows an attacker to inject malicious or unintended CSS into the page output. This bypasses the inline CSS sanitizer, potentially enabling style-based defacement, click\u2011jacking, or obscure XSS vectors. The weakness is classified under CWE\u2011116 for improper output encoding and has a CVSS score of 2.3, indicating low severity but the impact could still harm user experience or enable subtle content manipulation.", "risk_and_exploitability": "Because the CVSS is 2.3 and EPSS is less than 1%, the risk of exploitation is considered very low. The likely attack vector is content manipulation via magic words that the extension processes, which is inferred from the description. Since the issue involves output encoding, an attacker would need to inject crafted CSS through approved content or magic word processing to affect the rendering for users who view these pages. The vulnerability is not listed in CISA\u2019s KEV catalog, further supporting its low exploitation likelihood."}}}}, "created": "2026-01-09T13:24:05.534335+00:00", "updated": "2026-04-18T07:30:36.035843+00:00", "vendors": ["mediawiki", "mediawiki$PRODUCT$mediawiki", "wikimedia", "wikimedia$PRODUCT$mediawiki-approvedrevs_extension"]}