Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.



This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
Published: 2026-07-01
Score: 0 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an Improper Neutralization of Input During Web Page Generation (CWE‑79) flaw in MediaWiki that allows a malicious user to inject arbitrary JavaScript into the Special:ApiSandbox page. This stored cross‑site scripting can be abused when a deprecated module is selected, enabling session hijacking, defacement, or other client‑side attacks if an attacker can influence input that is subsequently rendered.

Affected Systems

MediaWiki versions from 1.46.0‑rc.0 through just before the final 1.46.0 release are vulnerable. Any installation derived from these releases uses the Special:ApiSandbox interface and the deprecated module, placing it at risk.

Risk and Exploitability

The CVSS score of 4.6 indicates low‑to‑moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The issue is not listed in CISA KEV. The likely attack vector is web‑based interaction with the Special:ApiSandbox page, where an attacker can provide malicious input that is stored and later rendered to users, producing client‑side code execution.

Generated by OpenCVE AI on July 22, 2026 at 14:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest stable MediaWiki release that contains the fix for the XSS flaw.
  • Disable or remove the deprecated module that triggers the vulnerability and ensure that Special:ApiSandbox input is properly escaped before rendering, following CWE‑79 best practices.
  • Monitor vendor advisories and security updates, and test custom extensions to verify no additional XSS paths remain.

Generated by OpenCVE AI on July 22, 2026 at 14:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}

threat_severity

Moderate

Thu, 02 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia mediawiki
Vendors & Products Wikimedia
Wikimedia mediawiki

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
Title Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 0, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wikimedia Mediawiki
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T14:45:46.186Z

Reserved: 2026-06-27T13:32:37.577Z

Link: CVE-2026-58031

cve-icon Vulnrichment

Updated: 2026-07-01T14:45:43.085Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-01T14:24:21Z

Links: CVE-2026-58031 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T14:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')