MediaWiki Extensions and Skins Security Release Supplement (1.43.7/1.44.4/1.45.2)

--===============0209415085148881184==
Content-Type: multipart/alternative; boundary="000000000000d160ed064efa2d6e"

--000000000000d160ed064efa2d6e
Content-Type: text/plain; charset="UTF-8"

Greetings-

With the security/maintenance release of MediaWiki 1.43.7/1.44.4/1.45.2, we
would also like to provide this supplementary announcement of MediaWiki
extensions and skins with now-public Phabricator tasks, security patches
and backports [1]:

ReportIncident
+ (T414582, CVE-2026-5762) - ReportIncident DiscussionTools integration
causes slow requests with occasional timeouts on large talk pages
https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60b4dd

ProofreadPage
+ (T406088, CVE-2026-39838) - ProofreadPage improperly sanitizes multiline
styles using Sanitizer::checkCSS
https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bdd0628

Cargo
+ (T416271, CVE-2026-39839) - Stored XSS through URLs in Cargo's map format
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237977

Cargo
+ (T416368, CVE-2026-39840) - CSS injection in multiple Cargo display
formats
https://gerrit.wikimedia.org/r/c/1237966

Cargo
+ (T416389, CVE-2026-39841) - Stored XSS through list fields on Cargo's
page values and Special:CargoTables
https://gerrit.wikimedia.org/r/c/1237973

Cargo
+ (T416402, CVE-2026-39837) - Stored XSS through the dynamic table format
in Cargo
https://gerrit.wikimedia.org/r/c/1237979

WikiLove
+(T416502, CVE-2026-22711) - Stored XSS through system messages in WikiLove
https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3

CentralAuth
+(T418122, CVE-2026-39937) - Global vanishing does not completely remove
user email
https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec3058edce85e

GlobalWatchlist
+(T418179, CVE-2026-39933) - Multiple XSS vulnerabilities in GlobalWatchlist
https://gerrit.wikimedia.org/r/q/I1fc7b7e1d234b0aaf9f7d782a65da1451577587e

GrowthExperiments
+(T418222, CVE-2026-39934) - ReassignMenteesJob runs as an infinite loop
https://gerrit.wikimedia.org/r/c/1243874

CampaignEvents
+(T418254, CVE-2026-39935) - Stored XSS through system messages
https://gerrit.wikimedia.org/r/c/1249320

Score
+(T419186, CVE-2026-39936) - Stored XSS due to usage of non-reserved data
attributes
https://gerrit.wikimedia.org/r/q/I1fb2913bc32328cbc4ecd4b4ad4a4788fb98c56c

RenderBlocking
+(GHSA-4h5r-8rjm-496r, CVE-2026-30977) - Stored XSS in renderblocking-css
with Inline Assets mode
https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be

The Wikimedia Security Team recommends updating these extensions and/or
skins to the current master branch or relevant, supported release branch
[2] as soon as possible. Some of the referenced Phabricator tasks above
_may_ still be private. Unfortunately, when security issues are reported,
sometimes sensitive information is exposed and since Phabricator is
historical, we cannot make these tasks public without exposing this
sensitive information. If you have any additional questions or concerns
regarding this update, please feel free to contact [email protected]
or file a security task within Phabricator [3]. CVE JSON references can be
found on Gitlab [4].

[1] https://phabricator.wikimedia.org/T411394
[2] https://www.mediawiki.org/wiki/Version_lifecycle
[3] https://www.mediawiki.org/wiki/Reporting_security_bugs
[4] https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

--000000000000d160ed064efa2d6e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Greetings-<br><br>With the security/maintenance release of=
 MediaWiki 1.43.7/1.44.4/1.45.2, we would also like to provide this supplem=
entary announcement of MediaWiki extensions and skins with now-public Phabr=
icator tasks, security patches and backports [1]:<br><br>ReportIncident<br>=
+ (T414582, CVE-2026-5762) - ReportIncident DiscussionTools integration cau=
ses slow requests with occasional timeouts on large talk pages<br><a href=
=3D"https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60b=
4dd">https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60=
b4dd</a><br><br>ProofreadPage<br>+ (T406088, CVE-2026-39838) - ProofreadPag=
e improperly sanitizes multiline styles using Sanitizer::checkCSS <br><a hr=
ef=3D"https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bd=
d0628">https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6b=
dd0628</a><br><br>Cargo<br>+ (T416271, CVE-2026-39839) - Stored XSS through=
 URLs in Cargo&#39;s map format<br><a href=3D"https://gerrit.wikimedia.org/=
r/c/mediawiki/extensions/Cargo/+/1237957">https://gerrit.wikimedia.org/r/c/=
mediawiki/extensions/Cargo/+/1237957</a><br><a href=3D"https://gerrit.wikim=
edia.org/r/c/mediawiki/extensions/Cargo/+/1237977">https://gerrit.wikimedia=
.org/r/c/mediawiki/extensions/Cargo/+/1237977</a><br><br>Cargo<br>+ (T41636=
8, CVE-2026-39840) - CSS injection in multiple Cargo display formats<br><a =
href=3D"https://gerrit.wikimedia.org/r/c/1237966">https://gerrit.wikimedia.=
org/r/c/1237966</a><br><br>Cargo<br>+ (T416389, CVE-2026-39841) - Stored XS=
S through list fields on Cargo&#39;s page values and Special:CargoTables<br=
><a href=3D"https://gerrit.wikimedia.org/r/c/1237973">https://gerrit.wikime=
dia.org/r/c/1237973</a><br><br>Cargo<br>+ (T416402, CVE-2026-39837) - Store=
d XSS through the dynamic table format in Cargo<br><a href=3D"https://gerri=
t.wikimedia.org/r/c/1237979">https://gerrit.wikimedia.org/r/c/1237979</a><b=
r><br>WikiLove<br>+(T416502, CVE-2026-22711) - Stored XSS through system me=
ssages in WikiLove<br><a href=3D"https://gerrit.wikimedia.org/r/q/Iab862094=
78a044504f5a6aea0d8c3d14f21c48b3">https://gerrit.wikimedia.org/r/q/Iab86209=
478a044504f5a6aea0d8c3d14f21c48b3</a><br><br>CentralAuth<br>+(T418122, CVE-=
2026-39937) - Global vanishing does not completely remove user email<br><a =
href=3D"https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec3058=
edce85e">https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec305=
8edce85e</a><br><br>GlobalWatchlist<br>+(T418179, CVE-2026-39933) - Multipl=
e XSS vulnerabilities in GlobalWatchlist<br><a href=3D"https://gerrit.wikim=
edia.org/r/q/I1fc7b7e1d234b0aaf9f7d782a65da1451577587e">https://gerrit.wiki=
media.org/r/q/I1fc7b7e1d234b0aaf9f7d782a65da1451577587e</a><br><br>GrowthEx=
periments<br>+(T418222, CVE-2026-39934) - ReassignMenteesJob runs as an inf=
inite loop<br><a href=3D"https://gerrit.wikimedia.org/r/c/1243874">https://=
gerrit.wikimedia.org/r/c/1243874</a><br><br>CampaignEvents<br>+(T418254, CV=
E-2026-39935) - Stored XSS through system messages<br><a href=3D"https://ge=
rrit.wikimedia.org/r/c/1249320">https://gerrit.wikimedia.org/r/c/1249320</a=
><br><br>Score<br>+(T419186, CVE-2026-39936) - Stored XSS due to usage of n=
on-reserved data attributes<br><a href=3D"https://gerrit.wikimedia.org/r/q/=
I1fb2913bc32328cbc4ecd4b4ad4a4788fb98c56c">https://gerrit.wikimedia.org/r/q=
/I1fb2913bc32328cbc4ecd4b4ad4a4788fb98c56c</a><br><br>RenderBlocking <br>+(=
GHSA-4h5r-8rjm-496r, CVE-2026-30977) - Stored XSS in renderblocking-css wit=
h Inline Assets mode<br><a href=3D"https://github.com/lihaohong6/RenderBloc=
king/commit/096fc47dad9dca153b02cba3db81f412c87fb2be">https://github.com/li=
haohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be</a>=
<br><br>The Wikimedia Security Team recommends updating these extensions an=
d/or skins to the current master branch or relevant, supported release bran=
ch [2] as soon as possible. Some of the referenced Phabricator tasks above =
_may_ still be private. Unfortunately, when security issues are reported, s=
ometimes sensitive information is exposed and since Phabricator is historic=
al, we cannot make these tasks public without exposing this sensitive infor=
mation. If you have any additional questions or concerns regarding this upd=
ate, please feel free to contact <a href=3D"mailto:[email protected]">=
[email protected]</a> or file a security task within Phabricator [3]. =
CVE JSON references can be found on Gitlab [4].<br><br>[1] <a href=3D"https=
://phabricator.wikimedia.org/T411394">https://phabricator.wikimedia.org/T41=
1394</a><br>[2] <a href=3D"https://www.mediawiki.org/wiki/Version_lifecycle=
">https://www.mediawiki.org/wiki/Version_lifecycle</a><br>[3] <a href=3D"ht=
tps://www.mediawiki.org/wiki/Reporting_security_bugs">https://www.mediawiki=
.org/wiki/Reporting_security_bugs</a><br>[4] <a href=3D"https://gitlab.wiki=
media.org/repos/security/wikimedia-cve-assignments">https://gitlab.wikimedi=
a.org/repos/security/wikimedia-cve-assignments</a></div>

--000000000000d160ed064efa2d6e--

--===============0209415085148881184==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
MediaWiki-l mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/
--===============0209415085148881184==--