CNNVD-202602-183 Information
CNNVD ID
CNNVD-202602-183
Related CVE
- CNNVD Published: 2026-02-03
Description (Chinese)
MediaWiki和Wikimedia Parsoid都是美国维基媒体（Wikimedia）基金会的产品。MediaWiki是一套自由免费的基于网络的Wiki引擎。该产品可用于部署内部的知识管理和内容管理系统。Wikimedia Parsoid是一个应用程序。提供一个一个允许在Wikitext和HTML之间来回转换的库。 Wikimedia MediaWiki和Wikimedia Parsoid存在安全漏洞，该漏洞源于程序文件存在输入中和不当，可能导致跨站脚本攻击。以下产品及版本受到影响：MediaWiki 1.39.14之前版本、1.43.4之前版本和1.44.1之前版本；Parsoid 0.16.6之前版本、0.20.4之前版本和0.21.1之前版本。
Description (English)
MediaWiki and Wikimedia Parsoid are products of the Wikimedia Foundation in the United States. MediaWiki is a free and free web-based Wiki engine. The product can be used for the deployment of internal knowledge management and content management systems. Wikimedia Parsoid is an application. Provides a library that allows for round-trip conversion between Wikitext and HTML. There is a security gap between WikimediaWiki and Wikimedia Parsoid, which stems from the inaccuracy of the programme document, which could lead to a cross-site scrip attack. The following products and versions were affected: pre-MediaWiki 1.39.14, pre-1.43.4 and pre-1.44.1; pre-Parsoid 0.16.6, pre-0.20.4 and pre-0.21.1.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
维基媒体
Published
2026-02-03
Last Modified
2026-02-24
References
https://phabricator.wikimedia.org/T401099
Patch
https://phabricator.wikimedia.org/T401099
Share on: