Based on the description, this vulnerability is an OS Command Injection flaw in the ExternalData Extension of MediaWiki, classified as CWE-78. An unauthenticated attacker can supply crafted wikitext that, when processed by the extension, causes the server to execute arbitrary operating‑system commands. The impact is full remote code execution, enabling compromise of confidentiality, integrity, and availability of the host system.

Affected systems include installations of the Wikimedia Foundation MediaWiki ExternalData Extension on all versions released before 3.7. No specific MediaWiki core component versions are mentioned as affected.

Based on the description, the likely attack vector is the submission of crafted wikitext that is processed by the ExternalData Extension, which is typically available to users with editing privileges. The CVSS score of 10 indicates maximum severity, while EPSS data is not available and the vulnerability is not yet listed in the CISA KEV catalog. Therefore, if an administrator is not restricting editing privileges, the risk remains high. Despite the lack of public exploitation evidence, the critical score and unauthenticated nature warrant immediate attention.