CVE-2026-100382: Unauthenticated remote code execution through wikitext in ExternalData

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-09-28
Weakness: CWE-78

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

Affected products

Wikimedia Foundation Mediawiki - ExternalData Extension: before 3.7 — fixed in 3.7

How to fix

Upgrade to a fixed version: Wikimedia Foundation Mediawiki - ExternalData Extension 3.7. Check the vendor advisory for mitigations.

References

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ExternalData/+/1326012
https://phabricator.wikimedia.org/T434961

Get alerted when CVE-2026-100382 or the next vulnerability affects your stack