The vulnerability is an improper neutralization of input during web page generation (CWE‑79) that allows the function mw.Api.getErrorMessage() to return injected HTML fragments unescaped when the errorformat=html parameter is omitted. This can cause malicious code execution in the context of a victim’s browser when the unescaped error message is rendered in a web page.

The issue affects the Wikimedia Foundation MediaWiki system. Any installation of MediaWiki prior to release 1.46.0, 1.45.4, 1.44.6, or 1.43.9 is vulnerable.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score is < 1%, indicating a low probability of exploitation, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker would need to supply a crafted request to the API endpoint that triggers the unescaped error message, which will then be rendered in a user’s browser as HTML. Without mitigations, a malicious actor could inject script payloads that execute in the context of the site with the privileges of the logged‑in user.