This vulnerability is an instance of CWE-79, improper neutralization of input during web page generation, leading to cross-site scripting (XSS) in the Wikimedia Foundation CheckUser extension. The affected component is modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. The vulnerability affects CheckUser versions starting at 1.46.0-rc.0 up to but not including 1.46.0. There is no vendor advisory indicating a patch or fix at this time.

Successful exploitation could allow an attacker with high privileges and authenticated user interaction to inject malicious scripts into web pages generated by the CheckUser extension. This could lead to execution of arbitrary scripts in the context of the affected web application. However, the vulnerability requires privileged access and user interaction, limiting its impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor for updates from the Wikimedia Foundation. Avoid exposing privileged interfaces unnecessarily and restrict access to trusted users as a precaution.