Is there a patch available for CVE-2026-58032?

Yes, a patch is available for CVE-2026-58032. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58032

Q: What is the CVSS score of CVE-2026-58032?

CVE-2026-58032 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41014 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-2pj3-wqpx-g8cm

XSS Mediawiki Wikimedia Foundation

5.3

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable with no privileges required, but victim interaction needed; only limited confidentiality impact with no integrity or availability effect, and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:03 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Cross-site scripting in MediaWiki's JavaScript API client layer (resources/src/mediawiki.Api/index.js) allows network-accessible, unauthenticated attackers to inject malicious scripts that execute in a victim's browser upon user interaction. All MediaWiki deployments prior to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected, covering a broad range of wiki installations worldwide. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of authentication requirement elevate concern for public-facing deployments.

Technical ContextAI

The vulnerable component is resources/src/mediawiki.Api/index.js, the core JavaScript API client used by MediaWiki's frontend to communicate with the MediaWiki REST/action API. MediaWiki is a PHP-based wiki platform (CPE: cpe:2.3:a:wikimedia_foundation:mediawiki) whose JavaScript layer relies on the mw.Api object extensively for dynamic content rendering, search, editing, and page interactions. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that data flowing through the API client - whether attacker-supplied input or unvalidated API responses - is written into the DOM without adequate sanitization or escaping, enabling script injection in the browser context of any user who interacts with affected content.

RemediationAI

Upgrade MediaWiki to one of the patched releases: 1.43.9, 1.44.6, 1.45.4, or 1.46.0, depending on the branch in use. The upstream fix is tracked at https://phabricator.wikimedia.org/T426867 and should be consulted for patch details and any deployment notes. Operators on unsupported or end-of-life MediaWiki branches should prioritize migration to a supported branch before applying the fix. As a compensating control, deploying a strict Content Security Policy (CSP) header that disallows inline script execution can reduce XSS exploitability, though this may conflict with MediaWiki's own JavaScript extensions and gadgets and requires careful testing in a staging environment before production rollout. Restricting anonymous or low-trust user edit permissions on sensitive wiki namespaces reduces the attack surface for content-injection vectors.