{"id":"GHSA-4h7g-5542-v3fc","summary":"mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function","details":"### Summary\nStored XSS through wikitext can be performed by inserting malicious HTML into the `overlays` parameter of the `display_map` parser function when using the leaflet service.\n\n### Details\nThe maps extension doesn't escape overlay names before passing them to leaflet.\nLeaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243\n\n### PoC\nPreview the following wikitext, using the default configuration options of the extension:\n```\n{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.\u003cimg src=x onerror=\"alert(1);\"\u003e}}\n```\n\n### Impact\nStored XSS can be performed by any user with the `edit` permission.","aliases":["CVE-2026-52854"],"modified":"2026-09-10T03:51:10.324148959Z","published":"2026-07-02T17:51:24Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-79","CWE-80"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-02T17:51:24Z"},"references":[{"type":"WEB","url":"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"},{"type":"PACKAGE","url":"https://github.com/ProfessionalWiki/Maps"}],"affected":[{"package":{"name":"mediawiki/maps","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/maps"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.3"}]}],"versions":["10.0.0","10.1.0","10.1.1","10.1.2","10.2.0","10.3.0","11.0.0","11.0.1","12.0.0","12.1.0","12.1.1","12.1.2","3.0","3.0-RC2","3.0.1","3.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.4.0","3.4.1","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.8.2","4.0.0","4.0.0-RC1","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.2.0","4.2.1","4.3.0","4.4.0","5.0.0","5.0.1","5.0.2","5.1.0","5.2.0","5.3.0","5.4.0","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.6.0","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.1.0","6.2.0","6.2.1","6.2.2","6.3.0","7.0.0","7.1.0","7.10.0","7.11.0","7.12.0","7.12.1","7.12.2","7.13.0","7.14.0","7.15.0","7.15.1","7.15.2","7.15.3","7.15.4","7.15.5","7.15.6","7.16.0","7.17.0","7.17.1","7.17.2","7.18.0","7.19.0","7.2.0","7.20.0","7.20.1","7.3.0","7.3.1","7.3.2","7.3.3","7.4.0","7.4.1","7.5.0","7.6.0","7.7.0","7.8.0","7.8.1","7.8.2","7.8.3","7.9.0","8.0.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-4h7g-5542-v3fc/GHSA-4h7g-5542-v3fc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"}]}