AIKIDO-2026-736811

mediawiki/maps is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-rg4f-xvhj-mw22 Published 4 days ago

High Risk

This Affects:

mediawiki/maps

0.0.1 - 12.1.7

Fixed in 12.1.8

13.0.0 - 13.1.0

Fixed in 13.1.1

14.0.0 - 14.1.0

Fixed in 14.1.1

Are you affected? Scan for Free

TL;DR

The Google Maps service passes a KML file referenced by the kml parameter to the vendored geoxml3 library, which builds map popup HTML from the document by string concatenation without sanitization. Content such as descriptions, balloon templates, and ExtendedData values is rendered into the info window, letting a KML document inject arbitrary markup and scripts into the wiki page. The refresh URL of a NetworkLink element is concatenated into a string passed to setInterval, so it is evaluated as code without any user interaction. The fix sanitizes popup content with DOMPurify, builds the ground overlay image with DOM APIs, and schedules a function call instead of a code string.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Google Maps service with the kml parameter to load KML files whose content untrusted users can influence.