A critical OS command injection vulnerability in the Wikimedia Mediawiki ExternalData extension allows unauthenticated attackers to achieve full system compromise.

This flaw is an OS command injection (CWE-78) occurring within the ExternalData extension. The vulnerability is exploitable by an unauthenticated attacker over the network with no required user interaction.

The impact of this vulnerability is severe, as it allows for complete unauthorized control over the underlying server hosting the Mediawiki instance. Given the CVSS score of 10.0, this represents a critical risk that could lead to full data exfiltration, total system compromise, and significant reputational damage if the server is used as a pivot point for further network infiltration.

Immediate Action: Update the Mediawiki ExternalData extension to version 3.7 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review web server and system access logs for anomalous command execution patterns or unexpected requests to the ExternalData extension endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter incoming traffic for shell metacharacters or suspicious command strings targeting the extension.

Public Exploit Available: No

This vulnerability presents a maximum-severity risk to any infrastructure running the affected Mediawiki extension. Security teams must prioritize the update to version 3.7 across all production environments. Delaying this remediation exposes the host system to potential remote code execution by unauthenticated actors.