CVE-2026-100382

The MediaWiki ExternalData extension, which lets wiki pages retrieve and display structured data from external sources, fails to properly neutralize special elements before using them in operating-system commands, yielding an OS command injection flaw (CWE-78). Because the vector is network-reachable with no privileges, no user interaction, and low attack complexity (CVSS 4.0: 10.0), an unauthenticated remote attacker who reaches a wiki page or entry point that invokes the extension can supply crafted input that is executed as a shell command on the web server. Successful exploitation gives arbitrary command execution as the web server user, allowing full compromise of the wiki's data and the underlying host. All sites running the extension on any version before 3.7 are affected; Wikimedia's own farms and third-party MediaWiki installations using ExternalData for data retrieval are the exposed population. No public proof-of-concept is known and the issue is not on CISA's KEV list, so exploitation status is currently none known.

What to do: Upgrade the ExternalData extension to version 3.7 or later immediately; if you cannot upgrade right away, disable the extension (remove it from LocalSettings.php / $wgExtensionCredits) to remove the attack surface. Audit the affected host for signs of compromise, such as unexpected processes running as the web server user, unfamiliar files in the MediaWiki tree, and log entries showing anomalous requests to pages using #get_external_data or related ExternalData parser functions. Restrict direct web access to the server (VPN/IP allowlisting) as a temporary mitigating control where feasible.