This vulnerability (CVE-2026-58030) is an instance of CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting (XSS). It affects the Wikimedia Foundation's SyntaxHighlight_GeSHi extension, specifically in the includes/SyntaxHighlight.Php file. The issue allows untrusted input to be processed in a way that could enable script injection in web pages generated by the affected software. The affected versions include all versions before 1.46.0, as well as specific versions 1.45.4, 1.44.6, and 1.43.9. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the CVSS vector indicates no user interaction is required, low attack complexity, and low privileges needed, but the overall impact is limited to confidentiality with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the Wikimedia Foundation's advisories for updates. Until a patch is available, consider restricting access to the affected component or applying input validation and output encoding as temporary mitigations if feasible.