This vulnerability (CVE-2026-100382) in the Mediawiki ExternalData Extension arises from improper neutralization of special elements in OS commands, classified as CWE-78 (OS Command Injection). It allows unauthenticated remote attackers to inject and execute arbitrary OS commands. The affected versions include all releases before 3.7. The CVSS 4.0 vector indicates network attack vector, no required privileges or user interaction, and high impact on all security properties. No vendor advisory or patch information is available in the provided data.

Successful exploitation can lead to full compromise of the affected system, including unauthorized command execution with the privileges of the Mediawiki process. This impacts confidentiality, integrity, and availability of the system. Given the critical CVSS score of 10.0, the vulnerability poses a severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Mediawiki ExternalData Extension and monitor for suspicious activity related to command execution. Avoid exposing the vulnerable extension to untrusted users or networks.