Description

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:16.097Z",
  "pubdate": "2026-09-14T07:17:16.097Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the MassMessage extension for MediaWiki, specifically affecting versions prior to 1.40.2.\nThe vulnerability arises from improper handling of the 'uselang' parameter during the rendering of the 'massmessage-form-page-help' i18n key.\nBy crafting a malicious 'uselang' value, an unauthenticated or authenticated attacker can inject arbitrary JavaScript into the user's browser session.\nThe successful exploitation of this vulnerability leads to the execution of malicious scripts in the context of the victim's session, potentially resulting in session hijacking, unauthorized actions performed on behalf of the user, or information disclosure.\nThe flaw impacts systems running the MassMessage extension on MediaWiki platforms. The risk is considered significant as it allows for client-side code execution without requiring complex infrastructure-level access, relying primarily on user interaction with a maliciously crafted URL.",
  "technicalDetails": "The vulnerability is localized within the MassMessage extension's handling of localization (i18n) keys when rendered via the 'Special:MassMessage' endpoint.\nSpecifically, the application fails to adequately sanitize or escape the input provided through the 'uselang' URL parameter before reflecting it within the 'massmessage-form-page-help' i18n key.\nWhen a user accesses the 'Special:MassMessage' page with a specifically crafted 'uselang' parameter, the underlying MediaWiki localization mechanism processes the provided string. If the application logic reflects this input back into the document object model (DOM) without proper context-aware encoding, the browser interprets the input as executable content rather than plain text.\nThe attack flow begins when an attacker distributes a crafted URL targeting the 'Special:MassMessage' path, manipulating the 'uselang' query string parameter to contain a cross-site scripting payload. When an unsuspecting user clicks this link, the web server processes the request and instructs the client browser to render the page, including the injected JavaScript payload embedded within the 'massmessage-form-page-help' message.\nBecause the payload executes within the security context of the MediaWiki installation's domain, the malicious script can access sensitive data stored in local storage, session storage, or cookies (if the HttpOnly flag is not strictly enforced). Furthermore, the attacker can leverage the victim's session to perform authenticated actions, such as modifying configuration settings, injecting content into the wiki, or exfiltrating private user data.\nThe flaw is present in all versions of the MassMessage extension integrated with MediaWiki prior to the 1.40.2 release. The vulnerability does not require the attacker to have administrative privileges on the wiki, as the injection point is public-facing. It does not require prior authentication to the application, making it highly exploitable via social engineering or reflected link-based attacks."
}