From email to security@
Hi Security team, I found a stored XSS issue in the Chart extension’s progressive enhancement path. The vulnerable flow is specific to pie charts. A malicious title in a numeric field inside a Data:*.tab page is preserved into the client chart spec as spec.series[0].data[*].name. On the client side, Chart/resources/ext.chart/render.js uses that value as raw params.name inside the pie tooltip formatter, and the bundled ECharts build renders tooltip HTML via innerHTML. As a result, attacker-controlled HTML in the field title can execute when another user views the page and triggers the tooltip by hover/tap. I validated this against the local source at: - mediawiki/extensions/Chart commit 2f96bb9f59b9d65a2f460066e800ce35cc1796f4 - mediawiki/services/chart-renderer commit 543b8eec4fa9f56110f3fa3d6957c077e5dc4438 - mediawiki/extensions/JsonConfig commit 27d9983a1244743f12d3cb0e3403f51d9fa32852 Relevant code points: - Chart/resources/ext.chart/render.js: pie tooltip formatter returns raw params.name - Chart/lib/echarts/echarts.common.js: tooltip HTML mode defaults to HTML and inserts formatter output with innerHTML - chart-renderer/src/lib/charts/pieChart.ts: pie slice name is taken from numeric column title - chart-renderer/src/lib/render.ts: the generated spec is embedded into data-mw-chart - JsonConfig/includes/JCTabularContent.php: .tab field titles are accepted as localized strings, not HTML-sanitized Minimal reproduction: 1. Create Data:XssPie.tab with a numeric field whose title is <img src=x onerror=alert(1)> 2. Create Data:XssPie.chart with type: "pie" and source: "XssPie.tab" 3. Render the chart on a page 4. View the page and trigger the pie tooltip Observed result: - the malicious title survives into data-mw-chart.spec.series[0].data[*].name - the tooltip formatter returns HTML containing the raw payload - the payload executes when the tooltip is shown Expected result: - attacker-controlled field titles should be treated as text in tooltips, not executable HTML Impact: This appears to be cross-user stored XSS for users who can create or edit the relevant Data: pages and get the chart rendered to other viewers. I also checked the local Wikimedia config path: Chart is enabled, progressive enhancement is enabled, and Data: chart/tab content is configured through JsonConfig on Commons. I did not rely on production testing. Best, Fase Rais Baradika
