News for hackers. Stuff that matters.

A comment on Wikipedia in read-only mode following mass admin account compromise. Parent comment

Re:Wikipedia in read-only mode following mass admin account ... by _verandaguy on Thursday March 05, 2026 @02:55PM (#47266458) 

    > Based on the fact user scripts are globally disabled now I'm guessing this was a vector.
Disabled at which level?

Browsers still allow for user scripts via tools like TamperMonkey and GreaseMonkey, and that's not enforceable (and arguably, not even trivially visible) to sites, including Wikipedia.

As I say that out loud, I figure there's a separate ecosystem of Wikipedia-specific user scripts, but arguably the same problem exists.

[ Parent | on HN ]
Re:Wikipedia in read-only mode following mass admin account ... by howenterprisey on Thursday March 05, 2026 @03:02PM (#47266545)
Yeah, wikipedia has its own user script system, and that was what was disabled.
[ Parent | on HN ]
Re:Wikipedia in read-only mode following mass admin account ... by Wikipedianon on Thursday March 05, 2026 @03:39PM (#47266979)
The sitewide JavaScript/CSS is an editable Wiki page.

You can also upload scripts to be shared and executed by other users.

[ Parent | on HN ]
Re:Wikipedia in read-only mode following mass admin account ... by karel-3d on Thursday March 05, 2026 @03:34PM (#47266924)
This is apparently not done browser side but server side.

As in, user can upload whatever they wish and it will be shown to them and ran, as JS, fully privileged and all.

[ Parent | on HN ]