CirrusSearch’s pretty explain output copied the original search term into an HTML diagnostic heading without escaping it. A crafted search URL could make a victim’s browser execute that markup in the wiki’s origin.
Technical details
The search API accepted the cirrusDumpResult and cirrusExplain=pretty options without an authorization check. The original srsearch value was used to build a diagnostic description, which was then included in an explain response served as text/html.
The search backend needed to be configured and available for the diagnostic route to complete. The finding did not require an account or a special permission. The CVE record lists CirrusSearch through version 1.46.0 as affected.
Reproduction
- Confirm that CirrusSearch is installed and a search backend is working.
- Open a search API URL with
cirrusDumpResult=1 and cirrusExplain=pretty.
- Set
srsearch to a script element that changes the document title to a harmless marker.
- The diagnostic heading includes the raw element, and the browser changes the title.
Impact
JavaScript ran in the wiki origin when a victim opened the crafted URL. It could access data and perform actions available to that victim, subject to their permissions and browser protections.
References
CirrusSearch's pretty explain output copied the original search term into an HTML diagnostic heading without escaping it. A crafted search URL could make a victim's browser execute that markup in the wiki's origin.
## Technical details
The search API accepted the `cirrusDumpResult` and `cirrusExplain=pretty` options without an authorization check. The original `srsearch` value was used to build a diagnostic description, which was then included in an explain response served as `text/html`.
The search backend needed to be configured and available for the diagnostic route to complete. The finding did not require an account or a special permission. The CVE record lists CirrusSearch through version 1.46.0 as affected.
## Reproduction
1. Confirm that CirrusSearch is installed and a search backend is working.
2. Open a search API URL with `cirrusDumpResult=1` and `cirrusExplain=pretty`.
3. Set `srsearch` to a script element that changes the document title to a harmless marker.
4. The diagnostic heading includes the raw element, and the browser changes the title.
## Impact
JavaScript ran in the wiki origin when a victim opened the crafted URL. It could access data and perform actions available to that victim, subject to their permissions and browser protections.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96873)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96873)
- [CirrusSearch fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CirrusSearch/+/1344368)
- [Research index](/about/)
BomboBombone.exe