This vulnerability in Wikimedia Foundation CheckUser version 1.46.0-rc.0 involves improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). The affected code is located in modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. No official patch or remediation level has been published yet. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, high privileges required, user interaction required, and no impact on confidentiality, integrity, or availability.

An attacker with high privileges and requiring user interaction could exploit this vulnerability to execute arbitrary scripts in the context of the affected web pages. However, the CVSS vector indicates no direct impact on confidentiality, integrity, or availability. This limits the potential damage primarily to script execution within the user interface, which could lead to session hijacking or UI manipulation under specific conditions.

Patch status is not yet confirmed — check the Wikimedia Foundation advisory for current remediation guidance. Until an official fix is released, limit access to the affected CheckUser version 1.46.0-rc.0 to trusted users only and monitor for any suspicious activity related to the extension.