MediaWiki CVE-2026-58035

Exploitation requires the attacker to already hold high-privileged (administrator or equivalent) access to the MediaWiki installation - specifically, rights to use Special:Block. The wiki must be running a MediaWiki version that includes the Vue.js-based SpecialBlock.Vue component. A victim with sufficient privileges must passively interact with or view the page rendering the injected content (e.g., block log, block confirmation), satisfying the UI:P condition in the CVSS 4.0 vector. Exploitation is blocked for unauthenticated visitors and unprivileged editors; it is constrained to the administrative tier of a given wiki instance and does not enable unauthenticated remote code execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms network exploitability with low complexity but mandates high attacker privileges and passive victim user interaction - PR:H strongly constrains the realistic attacker pool to wiki administrators or similarly privileged accounts. Notably, all vulnerable-system and subsequent-system impact metrics in the provided vector are scored N (None), which is atypical for XSS and likely reflects conservative or preliminary scoring; a successful XSS ordinarily carries at least low confidentiality and integrity impact against victim sessions. No EPSS data is available, no KEV listing exists, and no public exploit code has been identified - these signals collectively indicate low near-term exploitation pressure. The practical risk is further bounded by the niche nature of the Special:Block admin page; however, stored or reflected XSS on administrator-only pages can enable admin-to-admin session hijacking or privilege chaining, which warrants patching despite the reduced surface.

An attacker who holds wiki administrator credentials navigates to Special:Block and submits a block action containing a crafted XSS payload embedded in a user-input field that is rendered unsanitized by SpecialBlock.Vue. When a second administrator or privileged user views the resulting block confirmation or block log entry, the injected script executes in their browser, potentially exfiltrating session tokens or performing privileged actions on their behalf. No public proof-of-concept has been identified at time of analysis.