This vulnerability (CVE-2026-58032) in MediaWiki arises from improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It is associated with the program file resources/src/mediawiki.Api/index.js. The affected versions include all releases before 1.43.9, 1.44.6, 1.45.4, and 1.46.0. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. As of the published date, no official fix or patch has been documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions limited by the low confidentiality impact. However, the overall impact is rated medium severity with no known exploits in the wild.

Patch status is not yet confirmed — check the Wikimedia Foundation advisory for current remediation guidance. Until an official fix is released, users should apply general security best practices for XSS mitigation and monitor for updates from the vendor.