Critical severity · published Sep 25, 2026
CVE-2026-100382
Unauthenticated remote code execution through wikitext in ExternalData
10.0
CVSS
1.2%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection.
This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mediawiki - ExternalData Extension · Wikimedia Foundation
before 3.7 · source: vendor
Affected product
ME
Mediawiki - ExternalData Extension
Wikimedia Foundation