This vulnerability is an instance of CWE-79, where user input is not properly sanitized or neutralized during the generation of web pages, specifically within the ApiSandboxLayout.js resource of MediaWiki. This flaw allows for potential cross-site scripting attacks, which could enable an attacker to inject malicious scripts into web pages viewed by other users. The affected versions are from 1.46.0-rc.0 before 1.46.0. There is no vendor advisory or patch information currently available to confirm remediation status.

The vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of users viewing the affected MediaWiki pages, potentially leading to session hijacking, defacement, or other malicious actions typical of XSS attacks. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input in the affected MediaWiki versions and consider applying any available workarounds recommended by the Wikimedia Foundation.