Self-Propagating JavaScript Worm Vandalized Nearly 4,000 Wikipedia Pages in 23 Minutes Before Engineers Contained the Spread
A dormant malicious script planted on Russian Wikipedia in 2024 was inadvertently activated during a Wikimedia security review, modifying thousands of pages and 85 user scripts before engineers locked down editing across all projects.
Overview
On March 5, 2026, a self-propagating JavaScript worm tore through Wikipedia and other Wikimedia projects, modifying approximately 3,996 pages and replacing around 85 user script files in a 23-minute window before engineers contained the outbreak. The incident, which the Wikimedia Foundation has formally designated the March 2026 User Script Incident, began when Foundation staff inadvertently activated dormant malicious code during a routine security review of user-authored scripts.
No personal data was breached and no permanent damage resulted, but the episode has highlighted long-standing architectural risks in the way Wikimedia projects handle client-side JavaScript.
How the Worm Worked
The malicious payload was traced to a script hosted on Russian Wikipedia at User:Ololoshka562/test.js, first uploaded in March 2024, according to BleepingComputer. The script had sat dormant for two years before being executed, reportedly by a Wikimedia employee account conducting user-script testing. Whether the activation was accidental or the result of a compromised account has not been publicly clarified.
Once triggered, the worm exploited two persistence vectors, as detailed in the Wikimedia Foundation’s incident report. At the user level, it modified individual User:<username>/common.js files so that the malicious script would auto-load whenever the affected user browsed any wiki while logged in. At the site level, if the compromised user held sufficient editing privileges, the worm attempted to inject itself into the global MediaWiki:Common.js file, which runs for every editor on the project.
Each newly infected user then became a propagation node: their browser would load the worm on the next page view and begin modifying additional pages and user scripts. According to SecureBlink, the worm used the Special:Random command to select pages for vandalism, injecting hidden JavaScript loaders embedded in image references and hidden span elements.
Impact
The worm was active for approximately 23 minutes before Wikimedia engineers cut off its ability to spread. During that window, approximately 3,996 pages were modified across Wikimedia projects, with Meta-Wiki bearing the brunt of the content changes and deletions, according to BleepingComputer. Around 85 user common.js files were replaced with the malicious payload, and an unknown number of pages were deleted outright.
The Wikimedia Foundation stated that no personal information was breached and that the incident did not constitute an external attack on Wikipedia’s infrastructure. All modified content was reverted, compromised user scripts were restored, and change histories containing the injected code were suppressed.
Wikimedia’s Response
Engineers temporarily restricted editing across all Wikimedia projects to halt the worm’s propagation, then methodically reverted the malicious changes and removed references to the injected scripts, according to BleepingComputer. Community stewards coordinated with Foundation staff to identify and clean up affected pages and user script files.
The Foundation published a formal incident report on Meta-Wiki and noted that a detailed post-incident analysis was underway.
What We Don’t Know
Several questions remain unanswered. The circumstances of the initial activation are unclear: the Foundation has said only that the script was executed during a security review, without specifying whether it was an inadvertent click, an automated scan that triggered the code, or a compromised account. It is also unknown whether similar dormant scripts exist elsewhere in the Wikimedia ecosystem, or how the original malicious code passed undetected for two years.
A Structural Vulnerability
The incident underscores a well-known tension in the Wikimedia architecture. Wikis rely on client-side gadgets and global JavaScript as core features that power everything from editing tools to accessibility aids. That architectural flexibility also creates a broad attack surface: any malicious code placed in site-wide scripts runs with full page privileges for every visitor who loads it, enabling both visible vandalism and stealthy persistence.
Community investigators have noted that similar self-propagating scripts were observed targeting smaller Russian-language wikis as far back as 2023, suggesting the technique was not novel. Whether the Foundation’s post-incident review will result in structural changes to how user scripts are vetted and sandboxed remains to be seen.