WikiLambda’s public function API checked for unsaved code only at the top level of an implementation. An anonymous caller could place a code implementation deeper inside a Z825 abstract-fragment composition and have it forwarded to the configured evaluator without the unsaved-code permission.
Technical details
WikiLambda normally rejects an unsaved implementation unless the caller has the wikilambda-execute-unsaved-code right. The check treated a top-level Z825 implementation as an unconditional exception, but did not inspect the fragment’s nested composition. Code below that wrapper therefore escaped the authorization check.
The issue affected both the public wikifunctions_run API and the internal function-call API. The CVE record lists WikiLambda versions before 1.47.0 as affected.
Reproduction
- Configure WikiLambda with an evaluator endpoint.
- Submit an unsaved code implementation under an ordinary wrapper. The public API returns HTTP 403.
- Put the same code implementation inside a Z825 wrapper and submit it again.
- The public API returns HTTP 200 and forwards the nested implementation to the evaluator.
Impact
An unauthenticated caller could submit arbitrary code to the configured WikiLambda evaluator despite the unsaved-code permission boundary. The evaluator runs code in a WASM sandbox, so the impact depends on the evaluator’s configuration and privileges.
References
WikiLambda's public function API checked for unsaved code only at the top level of an implementation. An anonymous caller could place a code implementation deeper inside a Z825 abstract-fragment composition and have it forwarded to the configured evaluator without the unsaved-code permission.
## Technical details
WikiLambda normally rejects an unsaved implementation unless the caller has the `wikilambda-execute-unsaved-code` right. The check treated a top-level Z825 implementation as an unconditional exception, but did not inspect the fragment's nested composition. Code below that wrapper therefore escaped the authorization check.
The issue affected both the public `wikifunctions_run` API and the internal function-call API. The CVE record lists WikiLambda versions before 1.47.0 as affected.
## Reproduction
1. Configure WikiLambda with an evaluator endpoint.
2. Submit an unsaved code implementation under an ordinary wrapper. The public API returns HTTP 403.
3. Put the same code implementation inside a Z825 wrapper and submit it again.
4. The public API returns HTTP 200 and forwards the nested implementation to the evaluator.
## Impact
An unauthenticated caller could submit arbitrary code to the configured WikiLambda evaluator despite the unsaved-code permission boundary. The evaluator runs code in a WASM sandbox, so the impact depends on the evaluator's configuration and privileges.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96872)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96872)
- [WikiLambda fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326392)
- [Research index](/about/)
BomboBombone.exe