CVE-2026-30917

Description

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Bucket table field that has a PAGE type, which will execute whenever a user views that table's corresponding Bucket namespace page. This vulnerability is fixed in 2.1.1.

PUBLISHED Reserved 2026-03-07 | Published 2026-03-09 | Updated 2026-03-10 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...Bucket/security/advisories/GHSA-8jrp-37wc-5v7c

github.com/...ommit/46ec08876ba9064987f20e8f42690854202a73ff

github.com/...ommit/cba9cf9c8751e9f3e6d559f44cadc39b84f7bff6

cve.org (CVE-2026-30917)

nvd.nist.gov (CVE-2026-30917)

Download JSON