This vulnerability in MediaWiki 1.46.0-rc.0 arises from improper neutralization of input during web page generation, specifically in the resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.js file. It is classified as CWE-79 (Cross-site Scripting). The issue could allow an attacker with limited privileges to inject malicious scripts that execute in the context of other users. The CVSS 4.0 vector indicates network attack vector, low complexity, low privileges required, and user interaction needed, with no confidentiality, integrity, or availability impact. No official fix or patch has been documented as of the publication date.

The vulnerability could enable an attacker to execute arbitrary scripts in the context of users interacting with the affected MediaWiki instance, potentially leading to session hijacking or other client-side attacks. However, the CVSS vector indicates no direct impact on confidentiality, integrity, or availability of the system itself. The attack requires user interaction and low privileges.

Patch status is not yet confirmed — check the Wikimedia Foundation advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input in the ApiSandbox feature. No vendor-provided mitigation or temporary fix is currently documented.