vulnerability

MediaWiki: CVE-2021-42042: Improper Neutralization of Input During Web Page Generation

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Oct 6, 2021

Added

Nov 26, 2021

Modified

May 6, 2026

Description

An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.

Solution

mediawiki-upgrade-latest

References

CVE-2021-42042
https://attackerkb.com/topics/CVE-2021-42042
https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f
https://phabricator.wikimedia.org/T290692
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-29030
CWE-79
EUVD-EUVD-2021-29030

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report