bombobombone/cve-2026-103446Report summary and local proof-of-concept script demonstrating the unauthenticated WikiLambda fragment execution flaw in CVE-2026-103446.
Reporter: Marco Paciaroni (BomboBombone).
The abstractwiki_run_fragment API did not check the permission required for caller-supplied unsaved fragments. Anonymous requests could therefore send native implementations to the configured WikiLambda evaluator. The report establishes unauthorized evaluator execution, not MediaWiki-host RCE or a WASM sandbox escape.
Configure a local WikiLambda client to send calls to 127.0.0.1:4020, then run the script against a local anonymous MediaWiki API. The script starts a loopback capture service and checks whether the submitted marker reaches it:
python poc.py --api http://127.0.0.1:4000/api.php
The API URL must be loopback. Run this only against a local test setup.