AIKIDO-2026-736811
mediawiki/maps is vulnerable to Cross-Site Scripting (XSS)
83
CVE Score
High
Cross-Site Scripting (XSS)
TL;DR
The Google Maps service passes a KML file referenced by the kml parameter to the vendored geoxml3 library, which builds map popup HTML from the document by string concatenation without sanitization. Content such as descriptions, balloon templates, and ExtendedData values is rendered into the info window, letting a KML document inject arbitrary markup and scripts into the wiki page. The refresh URL of a NetworkLink element is concatenated into a string passed to setInterval, so it is evaluated as code without any user interaction. The fix sanitizes popup content with DOMPurify, builds the ground overlay image with DOM APIs, and schedules a function call instead of a code string.
How do I fix this?
Upgrade the mediawiki/maps library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the Google Maps service with the kml parameter to load KML files whose content untrusted users can influence.
Package
Versions
0.0.1 - 12.1.7
Fixed in 12.1.813.0.0 - 13.1.0
Fixed in 13.1.114.0.0 - 14.1.0
Fixed in 14.1.1Background info
mediawiki/maps is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 12.1.7, 13.0.0 - 13.1.0 and 14.0.0 - 14.1.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.