Is there a patch available for CVE-2026-58034?

Yes, a patch is available for CVE-2026-58034. Update the affected software to the latest version immediately.

CheckUser CVE-2026-58034

EUVD-2026-41011 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-5m8f-rxqc-4gpj

XSS Checkuser Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

4.8 MEDIUM

PR:H reflects required CheckUser privileges; UI:R for victim interaction; S:C for browser-context script execution; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:58 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.

This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue.

This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.

AnalysisAI

Cross-site scripting in the Wikimedia Foundation CheckUser extension (versions 1.46.0-rc.0 up to but not including 1.46.0) allows a high-privileged attacker to inject malicious scripts via the blockConnectedTempAccountsField Vue component used in the Temporary Accounts blocking workflow. Exploitation requires both elevated CheckUser-level privileges and active user interaction from another party, materially constraining real-world risk. No public exploit code exists and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

CheckUser is a MediaWiki extension developed by the Wikimedia Foundation that grants designated administrators ('CheckUsers') the ability to investigate IP addresses, user accounts, and temporary account sessions. The vulnerable component is a Vue.js single-file component (blockConnectedTempAccountsField.Vue) within the ext.CheckUser.TempAccounts module, which handles the UI for blocking accounts connected to temporary (IP-masking) sessions. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied data is rendered into the DOM without adequate sanitization or escaping, allowing script injection. The CPE cpe:2.3:a:wikimedia_foundation:checkuser confirms the affected product is the Wikimedia Foundation's canonical CheckUser extension, not a third-party fork.

RemediationAI

Upgrade CheckUser to version 1.46.0 or later, which corrects the neutralization flaw in the blockConnectedTempAccountsField Vue component. The fix version 1.46.0 is the boundary stated in the CVE description. Site operators who installed the 1.46.0-rc.0 release candidate should treat this as an urgent update. As a compensating control prior to patching, wiki administrators can restrict the CheckUser user group to the absolute minimum set of trusted accounts, reducing the pool of users who could inject content into the affected field. Additionally, Content Security Policy (CSP) headers can be configured in MediaWiki to restrict inline script execution and limit XSS impact even if triggered. Refer to the vendor Phabricator task at https://phabricator.wikimedia.org/T428820 for further remediation detail.