This vulnerability in MediaWiki arises from improper input neutralization in the resources/src/mediawiki.Special.Block/SpecialBlock.Vue file, leading to a cross-site scripting (CWE-79) issue. The vulnerability affects version 1.46.0-rc.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, but user interaction is needed, and no confidentiality, integrity, or availability impact is noted. No official fix or patch has been published at this time.

An attacker could exploit this XSS vulnerability to execute arbitrary scripts in the context of the affected MediaWiki instance, potentially leading to session hijacking or other client-side attacks. However, the CVSS vector suggests no direct impact on confidentiality, integrity, or availability of the system. No known exploits are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input in the affected component and consider applying temporary mitigations such as input sanitization or disabling the vulnerable feature if feasible.