Hello @sbassett, Yes I would like to be added to the Security hall of fame, thank you !

I also have another question. I don't think this is necessary. But a CVE ID can be assigned to this bug or not? If yes, how is it going? Do I do the process or do you?

In T365644#9826062, @sbassett wrote:

@Chocapikk1337 -

In T365644#9824252, @Samwilson wrote:

I don't mind if you write it up on your blog.

Let's wait until the issue is fully-resolved and double-check with WMF-Legal. Most of the time they are fine with public write-ups by third-parties, but sometimes they're not.

We could also add you to our security hall of fame, if you're interested.

And I have a question, once this vulnerability is patched, may I have permission to discuss the details about the vulnerability on my blog https://chocapikk.com/ for educational purposes? I believe it could provide valuable insights to the community. Thanks

In T365644#9823294, @sbassett wrote:

At the very least, within Renderer->render(), $lang should be sanitized via escapeshellarg() or a limiting regular-expression/allow-list.