CVE-2026-30977 Details
Description
RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss user rights are required. This vulnerability is fixed in 0.1.1.
A stored cross-site scripting vulnerability has been identified in the MediaWiki RenderBlocking extension, specifically in versions through 0.1.0. The issue arises when the Inline Assets mode is enabled, allowing users with editsitecss permissions to inject malicious scripts into renderblocking-css. This vulnerability requires the '$wgRenderBlockingInlineAssets' setting to be true.
Users can update to version 0.1.1 of the RenderBlocking extension, which addresses the vulnerability by sanitizing CSS inputs to prevent script injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 10, 2026CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be | [email protected] | Source CodeVendor |
| https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1 | [email protected] | Release NotesVendor |
| https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lihaohong6 RenderBlocking | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |