Is there a patch available for CVE-2026-58031?

Yes, a patch is available for CVE-2026-58031. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58031

EUVD-2026-41012 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-f942-cxv6-p9mx

XSS Mediawiki Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required authenticated access; S:C and C:L/I:L capture XSS browser-side impact - session theft and DOM manipulation - which the all-N provided vector omits.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:58 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.

This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

AnalysisAI

Cross-site scripting in MediaWiki's ApiSandbox component (ApiSandboxLayout.js) allows an authenticated attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted ApiSandbox page. Only MediaWiki 1.46.0-rc.0 is confirmed affected; the 1.46.0 stable release resolves the flaw, meaning real-world exposure is limited to deployments running the release candidate. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

MediaWiki is the PHP-based wiki engine powering Wikipedia and thousands of other wikis. The affected component is Special:ApiSandbox, an interactive browser-based developer tool for testing MediaWiki API calls. The vulnerability resides in resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.js, a client-side JavaScript module responsible for rendering API sandbox layouts. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-controlled input is not properly sanitized or escaped before being written into the DOM, enabling script injection. The CPE string cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:* covers the MediaWiki application broadly, with the version range narrowed by the advisory to 1.46.0-rc.0 only.

RemediationAI

The primary remediation is to upgrade to MediaWiki 1.46.0 stable, which resolves the vulnerability. Deployments still running the 1.46.0-rc.0 release candidate should treat this as an urgent driver to migrate to the stable release. If an immediate upgrade is not feasible, access to the Special:ApiSandbox page can be restricted via MediaWiki's namespace or page protection mechanisms, limiting it to trusted administrator accounts only - this reduces the attack surface but does not eliminate the flaw. Additional context is available at https://phabricator.wikimedia.org/T426889. No other vendor workarounds are documented in available sources.