PT-2026-24343 · Unknown+1 · Renderblocking+1

Gui-Ying233 · CVE-2026-30977 · Published 2026-03-10 · Updated 2026-03-16

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MediaWiki RenderBlocking versions prior to 0.1.1

Description The RenderBlocking extension for MediaWiki allows interface administrators to specify render-blocking CSS and JavaScript. Prior to version 0.1.1, a Stored Cross-Site Scripting (XSS) issue exists in the renderblocking-css component when Inline Assets mode is enabled. This requires $wgRenderBlockingInlineAssets to be set to true and the user to have editsitecss permissions.

Recommendations Update to RenderBlocking version 0.1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30977

GHSA-4H5R-8RJM-496R

Affected Products

Mediawiki

Renderblocking

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30977.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30977 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30977 · Vendor Advisory
• https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be · Note
• https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r · Note
• https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1 · Note
• https://twitter.com/CVEnew/status/2033361098506715579 · Twitter Post