PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39933 The Wikimedia Foundation CVE debrief

CVE-2026-39933 is a Cross-Site Scripting (XSS) vulnerability in the Mediawiki - GlobalWatchlist Extension. The issue allows for improper neutralization of input during web page generation, potentially leading to unauthorized script execution. Remediation has been applied on the `master` branch and in MediaWiki versions 1.43, 1.44, and 1.45. Users should review their installations for exposure and apply patches or mitigations as necessary to prevent exploitation.

Vendor
The Wikimedia Foundation
Product
Mediawiki - GlobalWatchlist Extension
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-21
Advisory published
2026-04-07
Advisory updated
2026-07-21

Who should care

Users of Mediawiki - GlobalWatchlist Extension, particularly those responsible for maintaining and securing MediaWiki installations, should review their deployments for exposure and apply patches or mitigations as necessary. This includes administrators, security teams, and operators who manage MediaWiki environments.

Technical summary

The CVE-2026-39933 vulnerability is classified as a Cross-Site Scripting (XSS) issue. It arises from improper neutralization of input during web page generation in the Mediawiki - GlobalWatchlist Extension. The Common Vulnerability Scoring System (CVSS) score is 6.9, indicating a medium severity level. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it allows for Cross-Site Scripting (XSS) attacks.

Recommended defensive actions

  • Review and apply patches for MediaWiki versions 1.43, 1.44, and 1.45, and the `master` branch.
  • Implement input validation and output encoding for user-supplied data in the GlobalWatchlist Extension.
  • Monitor for suspicious activity and implement compensating controls if patching is not immediately feasible.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-07T22:16:23.980Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Awaiting Analysis. The issue has been remediated on the `master` branch and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T22:16:23.980Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.