Is there a patch available for CVE-2026-58035?

Yes, a patch is available for CVE-2026-58035. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58035

EUVD-2026-41009 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-gvg3-mcqq-v953

XSS Mediawiki Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

4.8 MEDIUM

Admin-only Special:Block page requires PR:H; XSS crosses scope boundary to victim browsers yielding S:C with low C and I impact on affected sessions.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:58 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

AnalysisAI

Cross-site scripting in MediaWiki's Special:Block Vue.js component allows a high-privileged user - such as a wiki administrator - to inject malicious scripts that execute in the browsers of other users who subsequently view the affected block interface output. The vulnerability is isolated to the SpecialBlock.Vue frontend component, gating exploitation behind administrative access. No public exploit has been identified at time of analysis, and no patch version has been confirmed from available data.

Technical ContextAI

MediaWiki is the open-source wiki platform maintained by the Wikimedia Foundation, powering Wikipedia and thousands of third-party wikis. The affected file resources/src/mediawiki.Special.Block/SpecialBlock.Vue is a Vue.js single-file component implementing the Special:Block administrative interface, which allows privileged users to block accounts. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input flowing into the Vue component's template rendering without sufficient sanitization or output encoding, causing the browser to interpret attacker-supplied data as executable script. The CPE cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:* covers all MediaWiki versions with no upper-bound fix version specified.

RemediationAI

No vendor-released patch has been identified at time of analysis - affected version range is based solely on a wildcard CPE with no confirmed fix version. Monitor the Wikimedia Phabricator task at https://phabricator.wikimedia.org/T428809 for patch release and apply the upstream fix via a MediaWiki version update as soon as it becomes available. As an immediate compensating control, audit and restrict Special:Block permissions (sysop, bureaucrat) to only the minimum set of trusted administrators required - this limits the pool of users capable of injecting content via the vulnerable interface. If the deployment supports it, consider reverting to a legacy PHP-based Special:Block implementation as a temporary measure, noting this may reduce block-interface functionality. Do not rely on client-side filtering alone, as XSS mitigations must be enforced server-side or at the template rendering layer.