CVE-2021-39186

    Dashboard / Vulnerabilities / CVE-2021-39186

    CVE-2021-39186

    Published: 1 Sept 2021Last Modified: 8 Jul 2026

    Summary:

    Details: GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.

    References: https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vg, https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, https://phabricator.miraheze.org/T7935

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39186 | CVE-DB