Cross-Site Scripting Vulnerability in MediaWiki by Wikimedia Foundation
CVE-2026-58031

NONE

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki
Vendor
CVE Published:
1 July 2026

What is CVE-2026-58031?

An improper neutralization of input during web page generation in MediaWiki allows attackers to execute malicious scripts in the context of the user's session. This vulnerability poses a risk to users accessing compromised pages, potentially leading to unauthorized actions and data exposure. It primarily affects MediaWiki versions from 1.46.0-rc.0 prior to 1.46.0, specifically related to the ApiSandboxLayout.Js file in the resources directory.

Affected Version(s)

MediaWiki 1.46.0-rc.0 < 1.46.0

References

https://phabricator.wikimedia.org/T426889

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.