CVE-2026-14358 is a CWE-79 cross-site scripting vulnerability in the Mediawiki - Charts Extension maintained by The Wikimedia Foundation. The vulnerability arises from improper input neutralization during web page generation, enabling injection of malicious scripts. Affected versions include all releases before 1.43.9, 1.44.6, and 1.45.4. No official remediation level or patch information is provided in the available data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, availability, scope, and security requirements.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing affected web pages, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the impact is rated medium, reflecting limited scope and impact severity based on the CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor The Wikimedia Foundation advisories for updates. Until a patch is available, consider restricting access or applying input validation controls if feasible.