CVE-2026-100382: Wikimedia Foundation Mediawiki - Externaldata Extension

Critical severity, CVSS 10.0. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

Affected products

• Wikimedia Foundation Mediawiki - Externaldata Extension: before 3.7 (fixed in 3.7)

Published 2026-09-25. Last modified 2026-09-28.