CVE-2026-52854: mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

July 2, 2026

Stored XSS through wikitext can be performed by inserting malicious HTML into the overlays parameter of the display_map parser function when using the leaflet service.

References

github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc
github.com/advisories/GHSA-4h7g-5542-v3fc
nvd.nist.gov/vuln/detail/CVE-2026-52854

Code Behaviors & Features

Detect and mitigate CVE-2026-52854 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →