{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30977", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:53:48.816Z", "datePublished": "2026-03-10T17:40:38.098Z", "dateUpdated": "2026-03-11T14:18:37.430Z"}, "containers": {"cna": {"title": "RenderBlocking has Stored XSS in renderblocking-css with Inline Assets mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r"}, {"name": "https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be", "tags": ["x_refsource_MISC"], "url": "https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be"}, {"name": "https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1"}], "affected": [{"vendor": "lihaohong6", "product": "RenderBlocking", "versions": [{"version": "< 0.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:40:38.098Z"}, "descriptions": [{"lang": "en", "value": "RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss user rights are required. This vulnerability is fixed in 0.1.1."}], "source": {"advisory": "GHSA-4h5r-8rjm-496r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:18:23.151930Z", "id": "CVE-2026-30977", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:18:37.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "RenderBlocking has Stored XSS in renderblocking-css with Inline Assets mode", "source": {"advisory": "GHSA-4h5r-8rjm-496r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "lihaohong6", "product": "RenderBlocking", "versions": [{"status": "affected", "version": "< 0.1.1"}]}], "references": [{"url": "https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r", "name": "https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be", "name": "https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1", "name": "https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss user rights are required. This vulnerability is fixed in 0.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:40:38.098Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30977", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:18:23.151930Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:18:27.685Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-30977", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:40:38.098Z", "dateReserved": "2026-03-07T17:53:48.816Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T17:40:38.098Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "RenderBlocking", "vendor": "lihaohong6", "versions": [{"status": "affected", "version": "< 0.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss user rights are required. This vulnerability is fixed in 0.1.1."}, {"lang": "es", "value": "RenderBlocking es una extensi\u00f3n de MediaWiki que permite a los administradores de interfaz especificar CSS y JavaScript de bloqueo de renderizado. Antes de la versi\u00f3n 0.1.1, existe una XSS Almacenada en renderblocking-css con el modo de Activos en L\u00ednea. Se requiere que $wgRenderBlockingInlineAssets = true y los derechos de usuario editsitecss. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.1.1."}], "id": "CVE-2026-30977", "lastModified": "2026-06-17T10:33:15.557", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30977", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:18:23.151930Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:56.370", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba3db81f412c87fb2be"}, {"source": "security-advisories@github.com", "url": "https://github.com/lihaohong6/RenderBlocking/releases/tag/v0.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "RenderBlocking", "source": "cna", "vendor": "lihaohong6"}, "product": "renderblocking", "vendor": "lihaohong6"}], "analysis": {"en": {"generated_at": "2026-04-16T03:45:45.427704+00:00", "value": {"mitigation_remediation": ["Upgrade RenderBlocking to version 0.1.1 or later", "If upgrading is delayed, disable the inline assets feature by setting $wgRenderBlockingInlineAssets = false to prevent stored script injection", "Limit the editsitecss user right to a minimal set of trusted administrators and regularly audit those permissions"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the RenderBlocking extension by lihaohong6, version 0.1.0 and earlier for MediaWiki. The vulnerability is resolved in version 0.1.1, which is the earliest release to include the fix.", "description_and_impact": "RenderBlocking, a MediaWiki extension that manages render\u2011blocking CSS and JavaScript, contained a stored XSS flaw in its inline assets mode. The vulnerability allowed a user with the editsitecss user right to embed malicious script code into site\u2011wide CSS files, which would then be stored and executed whenever any page was rendered. The flaw was limited to the inline asset feature enabled by the configuration variable $wgRenderBlockingInlineAssets, but once injected it could compromise all users who load the page. The available CVSS score of 2.0 reflects that the flaw does not enable arbitrary code execution on the server but poses a significant threat to web session integrity.", "risk_and_exploitability": "With an EPSS score of less than 1% and no current inclusion in the CISA KEV catalog, the likelihood of widespread exploitation is low, yet the impact for organizations that grant editsitecss rights to users remains substantial. Attackers must first possess the editsitecss privilege; once they do, they can inject persistent script payloads that run under the context of every user visiting affected pages. The CVSS score indicates that the main risk is client\u2011side and it does not compromise server\u2011side code or data directly, but it can undermine user trust and facilitate further phishing attempts."}}}}, "created": "2026-03-11T11:44:42.556348+00:00", "updated": "2026-04-16T04:00:09.423515+00:00", "vendors": ["lihaohong6", "lihaohong6$PRODUCT$renderblocking"]}