MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability

MEDIUM 6.1CVE-2024-34500 · BIT-mediawiki-2024-34500 · GHSA-wcx3-63mm-h8x6 · Published 05/05/2024 · updated 17/06/2026

In short

CVE-2024-34500 is a MEDIUM (CVSS 6.1) vulnerability affecting samwilson/unlinked-wikibase, mediawiki (mediawiki).
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 40.9% of all vulnerabilities.
Fix: update to 1.42.0, 1.40.2, 1.41.1, 1.39.6 or later.

Package	Affected versions	Patched versions
samwilson/unlinked-wikibase Packagist	`< 1.42.0`	`1.42.0`
mediawiki mediawiki	`≥ 1.40.0, < 1.40.2≥ 1.41.0, < 1.41.1< 1.39.6`	`1.40.21.41.11.39.6`

Description

An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.42.0. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

NVD description

An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free