CVE-2026-58521 describes an SQL injection vulnerability in the Mediawiki Cargo Extension maintained by The Wikimedia Foundation. The issue arises from improper neutralization of special elements used in SQL commands, allowing attackers to inject malicious SQL. The affected versions include all versions before 1.43.9, 1.44.6, and 1.45.4. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, availability, and scope. There is no vendor advisory or patch information provided to confirm remediation status.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the database used by the Mediawiki Cargo Extension, potentially leading to data disclosure, modification, or disruption of service. The CVSS score of 6.9 indicates a medium severity impact with limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor official Wikimedia Foundation channels for updates. No specific temporary mitigations are provided in the available data.