CVE-2026-52854 - mediawiki/maps Stored XSS Vulnerability

CVE-2026-52854 - mediawiki/maps: Stored XSS Vulnerability

CVE-2026-52854, with a HIGH CVSS 3.1 score of 8.6, addresses a stored Cross-Site Scripting (XSS) vulnerability within the mediawiki/maps extension. This vulnerability specifically impacts the overlays parameter in the display_map parser function. Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. The issue was published on August 18, 2026.

Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user’s browser session and can access data or perform actions available to that user. This vulnerability is remotely exploitable.

The CVSS 3.1 score is 8.6 (HIGH severity), with an Exploitability Score of 3.9 and an Impact Score of 4.7, sourced from security-advisories@github.com. CVE-2026-52854 is associated with the following Common Weakness Enumerations (CWEs): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) and CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-52854 weaknesses. Relevant CAPEC entries include CAPEC-63: Cross-Site Scripting (XSS) and CAPEC-592: Stored XSS.

This issue is fixed in version 12.1.3. To mitigate the risk, update the Maps MediaWiki extension to version 12.1.3 or later to fix the script execution vulnerability.

For more details, visit the full article 🚀.