CVE-2026-58038: MediaWiki Timeline XSS Vulnerability—CVSS 6.1 Patch Guidance

Technical summary

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation—XSS). It resides in includes/Timeline.php and scripts/EasyTimeline.pl within the MediaWiki timeline extension. The root cause is insufficient input sanitization when processing timeline markup or parameters before rendering them into the HTML output sent to clients. An attacker can supply specially crafted timeline syntax or embedded content that bypasses sanitization filters, causing the browser to execute embedded JavaScript. The attack surface is network-accessible; no special privileges or local access are required to submit a malicious timeline to a vulnerable wiki instance.

Business impact

Wiki operators and MediaWiki administrators face operational disruption and reputational risk. Successful exploitation could lead to session hijacking of editors, theft of authentication tokens, defacement of wiki content, or redirection of users to malicious sites. For public wikis or knowledge-sharing platforms, attackers could manipulate displayed information, damage user trust, or conduct credential theft from editors. Internal enterprise wikis storing sensitive documentation are at risk of unauthorized information disclosure if an attacker crafts a timeline that exfiltrates data via JavaScript.

Affected systems

MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are vulnerable. Any deployment running timeline functionality (the EasyTimeline extension or built-in timeline support) on unpatched versions is at risk. This includes public Wikimedia projects, private wiki instances, and enterprise knowledge management systems using MediaWiki. Systems running version 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later are not affected.

Exploitability

The vulnerability is moderately exploitable. It requires network access and user interaction—a visitor must view a page containing the malicious timeline—but does not require prior authentication or administrative privileges. An attacker can inject a malicious timeline via wiki editing (if edit permissions are open) or, on some configurations, through GET/POST parameters if timeline processing is exposed via API endpoints. The attack is not wormable in the traditional sense, but could be deployed at scale across multiple wiki instances if an attacker controls timeline content or can inject it into frequently viewed pages.

Remediation

Apply security updates immediately: upgrade to MediaWiki 1.43.9, 1.44.6, 1.45.4, 1.46.0, or any later stable release. Verify against the vendor advisory that your target version includes the fix. If immediate patching is not feasible, temporarily disable timeline functionality or restrict timeline editing to trusted administrators only. Implement wiki-wide input validation policies and consider deploying a Web Application Firewall (WAF) rule to detect and block common XSS payloads in timeline parameters.

Patch guidance

Review Wikimedia Foundation release notes and security advisories for your deployed MediaWiki major version. Confirm the specific patch version required for your installation. Test patches in a staging environment before production deployment to ensure compatibility with custom extensions or skins. When upgrading, review database upgrade scripts and test timeline rendering on sample content to confirm functionality is preserved. For instances with high edit velocity, coordinate the upgrade during a maintenance window to minimize disruption.

Detection guidance

Monitor wiki logs and application logs for unusual timeline parameters, especially those containing HTML entities, script tags, or JavaScript keywords ('onload', 'onerror', 'javascript:', etc.). Review recent edits to pages with timeline content for suspicious markup. Implement browser-based XSS detection using Content Security Policy (CSP) headers set to restrict script execution and log violations. Check web server access logs for requests with encoded XSS payloads in timeline-related URLs. Conduct a historical audit of timeline content created or modified during any known security incidents.

Why prioritize this

This vulnerability merits prompt patching due to its network-accessible nature, low complexity of exploitation, and potential for widespread impact across public wikis and internal knowledge systems. Although user interaction is required, the attack can target high-traffic pages, increasing the likelihood of successful exploitation. The CVSS score of 6.1 (MEDIUM) reflects moderate impact; however, the context of wiki security—where content integrity and user trust are paramount—elevates practical risk. Prioritize patching public-facing wikis and instances with permissive edit policies above closed or read-only deployments.

Risk score, explained

CVSS 3.1 score of 6.1 (MEDIUM severity) reflects an attack vector that is network-based and requires no privileges, but mandates user interaction. The scope is changed (cross-site impact), and integrity/confidentiality impact is rated as low in the base vector; availability is not affected. In context, wiki operators should weigh the low CVSS rating against the specific risk profile of their deployment. High-traffic public wikis with permissive editing should treat this as a higher practical priority than closed knowledge bases. The absence of CVSS temporal and environmental modifiers in the base score does not capture the full operational risk.

Frequently asked questions