CVE-2026-14358: MediaWiki Charts Extension XSS Vulnerability – Patch Guide

Technical summary

This is a reflected or stored XSS vulnerability (CWE-79) in the MediaWiki Charts Extension's input sanitization layer. The extension fails to properly neutralize user-supplied data before rendering it in HTML output during chart generation. The vulnerability is triggered when user input—likely chart configuration parameters, labels, or data values—is echoed back to the page without adequate escaping or validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network accessibility, low attack complexity, no privilege requirement, required user interaction, and cross-site scope impact affecting confidentiality and integrity.

Business impact

Wikis powered by MediaWiki with the Charts Extension enabled face risk of account compromise, session hijacking, and defacement if attackers inject malicious scripts. In enterprise or knowledge-management contexts where MediaWiki hosts sensitive documentation or internal communications, XSS can lead to credential theft, unauthorized information disclosure, or malware distribution to users. The cross-site nature (S:C in the vector) means the payload can affect user interactions beyond the immediate vulnerable parameter. However, the requirement for user interaction and the medium severity rating indicate this is not a critical infrastructure threat—it requires social engineering or content placement to be effective.

Affected systems

The MediaWiki Charts Extension in versions prior to 1.43.9 (version 1.43 branch), prior to 1.44.6 (version 1.44 branch), and prior to 1.45.4 (version 1.45 branch) are affected. Any MediaWiki installation with the Charts Extension enabled and running an older version is vulnerable. This includes both self-hosted MediaWiki instances and any third-party services relying on this extension. The vulnerability does not affect core MediaWiki; it is specific to the Charts Extension.

Exploitability

The attack is straightforward to execute: an attacker embeds a malicious payload in a chart parameter (such as a chart title, axis label, or data field), then tricks or socially engineers a user into viewing the page containing that chart. No authentication is required to craft the payload, and no special tools are needed beyond basic web knowledge. However, the attack's success depends entirely on user interaction—a user must actually render the page. The low attack complexity and network accessibility make this a viable threat for wiki administrators who host user-generated content or allow external contributions. Automated worm-like spread is unlikely unless the XSS is stored and automatically rendered to all visitors.

Remediation

Update the MediaWiki Charts Extension immediately to version 1.43.9, 1.44.6, or 1.45.4 or later, depending on your current version branch. Verify the extension version by checking the installed version against Wikimedia's official release notes. If your wiki allows user contributions to chart content, consider temporarily disabling the Charts Extension or restricting its use to trusted editors until patching is complete. Review recent chart additions and modifications for suspicious payloads.

Patch guidance

Verify your current Charts Extension version via the MediaWiki Special:Version page. Identify which version branch you are running (1.43.x, 1.44.x, or 1.45.x). Download and apply the patched version from Wikimedia's official extension repository—specifically version 1.43.9 or later for the 1.43 branch, 1.44.6 or later for the 1.44 branch, or 1.45.4 or later for the 1.45 branch. Back up your wiki database and LocalSettings.php before updating. Test chart rendering in a staging environment to confirm functionality before deploying to production.

Detection guidance

Monitor server logs and MediaWiki edit histories for unusual chart parameter modifications, particularly those containing HTML tags, script tags, or JavaScript event handlers in chart titles, labels, or data values. Search the wiki's recent changes for edits involving the Charts Extension that contain suspicious characters or encoded payloads. Use browser developer tools to inspect rendered chart elements for unexpected script tags. If you maintain a WAF or IDS, create signatures to detect XSS patterns in chart-related HTTP parameters. Check for execution of scripts originating from chart-rendered content using browser console logs or security monitoring tools.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS 6.1 MEDIUM score reflects the requirement for user interaction and the absence of availability impact. However, XSS on a wiki—especially one hosting internal or sensitive documentation—can undermine user trust and lead to credential harvesting. The fact that it affects multiple version branches and does not require privileges makes it a broad exposure. Prioritize patching if your wiki allows public or user-contributed content; deprioritize slightly if charts are authored only by trusted administrators.

Risk score, explained

The CVSS 6.1 score balances moderate severity with practical constraints. Confidentiality and integrity are both impacted (user sessions and page content can be compromised), but availability is not affected—users can still view the wiki. The attack requires user interaction, which is a limiting factor. Network accessibility and low complexity mean the barrier to attack is low. The cross-site scope extends the impact beyond the vulnerable component. An organization running this extension with open contribution policies faces higher real-world risk than one with restricted authorship, despite the numerical score being fixed.

Frequently asked questions