This vulnerability (CVE-2026-58035) in MediaWiki arises from improper neutralization of input during web page generation, leading to a cross-site scripting (CWE-79) issue in the SpecialBlock.Vue component. The affected version is 1.46.0-rc.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack prerequisites, but requires high privileges and user interaction. No vendor remediation or patch is currently documented, and no known exploits exist. The vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users viewing the affected page.

The vulnerability allows cross-site scripting attacks due to improper input neutralization in MediaWiki's SpecialBlock.Vue component. Exploitation requires high privileges and user interaction, limiting the scope of impact. There are no reported impacts on confidentiality, integrity, or availability beyond the XSS context. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor Wikimedia Foundation advisories for updates. Limit exposure by restricting high-privilege user access and exercising caution with user-generated content in the affected component until a fix is available.