The vulnerability is an improper neutralization of input during web page generation in the TemplateSandbox extension for Mediawiki, permitting cross‑site scripting. An attacker can craft a sandbox prefix that, when another user previews a page, injects malicious JavaScript into the rendered page. If a victim user views the preview, the script runs in their browser context, potentially allowing cookie theft, session hijacking, or defacement. The weakness is identified as CWE‑79.

Affected systems are installations of the TemplateSandbox extension from the Wikimedia Foundation that use versions prior to 1.46.1, 1.45.5, or 1.43.10. All Mediawiki sites that have the extension enabled and have not applied these specific patch releases are vulnerable.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation observed. Attackers would need to entice a user to preview a crafted page, which is a social engineering step; however, once a victim performs the preview, the injection occurs automatically. The overall likelihood of exploitation is moderate but not high, and the impact is limited to the browsing session of the victim user.