In T245850#5912492, @sbassett wrote:

Whoops, I think this task was being edited as the Security-Team was reviewing it :) Did the above commit get deployed to any relevant wikis (I know ext:Widget isn't part of WMF production)? That should probably happen soon since the patch for master is public. We should also try to backport this to supported release branches.

Yes, this patch is out to all gamepedia.com, wikia.org, and fandom.com wikis. I looked over WMF wikis and as far as I can tell WMF does not use Widgets.

Backports:

• https://gerrit.wikimedia.org/r/574556 (REL1_31)
• https://gerrit.wikimedia.org/r/574557 (REL1_33)
• https://gerrit.wikimedia.org/r/574558 (REL1_34)

Also added to T240400 for tracking and will request a CVE.

The {{#widget:}} tag can invoke non-widget pages (aside from mainspace pages) by simply invoking the full page name with the widget tag e.g. {{#widget:Template:Page name}}, which can allow any user to run style and script tags on any page.

Just as a point of note, you can do mainspace pages by doubling the colon.

This is a super commonly used extension in third party wikis. I think an email to mediawiki-l encouraging people to update might be a good idea.

Since this is a versioned extension @Yaron_Koren may additionally want to release and tag a new version to make the need to upgrade visible even more.

In T245850#5914122, @Bawolff wrote:

This is a super commonly used extension in third party wikis. I think an email to mediawiki-l encouraging people to update might be a good idea.

So we've tried to be a little better about this sort of information dispersal by adding tasks like T240400 to the release process, the end result being quarterly-ish emails to relevant mailing lists (1, 2, etc). We can certainly send out something to that effect sooner (like today or tomorrow), focused on this specific issue, if you feel that is warranted.