CVE-2023-22911: Fedoraproject Fedora

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

Affected products

• Fedoraproject Fedora: version 37 only
• Mediawiki Mediawiki: before 1.35.9 (fixed in 1.35.9); from 1.36.0, before 1.38.5 (fixed in 1.38.5); version 1.39.0 only

Published 2023-01-10. Last modified 2026-06-17.