MediaWiki TemplateSandbox EUVD-2026-87359

Exploitation requires the TemplateSandbox extension to be installed on a MediaWiki instance and an attacker holding a low-privileged authenticated account (PR:L) able to submit template/wikitext to the sandbox preview. It further requires active user interaction (UI:A): a victim must be induced to view the attacker-crafted preview or page for the injected script to execute in their browser session. These two gates - authentication plus victim interaction - substantially limit realistic exploitation; it is not remotely triggerable against a default page load without a targeted user. Impact is confined to browser-side script execution in the wiki origin (Low confidentiality/integrity/availability), not server-side compromise.

This is a genuinely low-to-moderate priority issue despite the CWE-79 XSS classification. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:A/VC:L/VI:L/VA:L) scores only 4.8 (medium), and the individual signals corroborate a low real-world risk: exploitation requires at least low-level privileges (PR:L - an authenticated wiki account) AND active user interaction (UI:A - a victim must be induced to view the crafted preview/page). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact metrics are uniformly Low (VC:L/VI:L/VA:L) rather than High, consistent with a script-execution-in-browser XSS rather than server compromise. The 4.0 vector marks subsequent-system impacts (SC:L/SI:L/SA:L) as Low, hinting the extension author considered a limited cross-context effect (script running in another user's authenticated wiki session). No signals conflict; all point to a real but not urgent, doubly-gated (auth + interaction) flaw in a niche MediaWiki extension.

An attacker with a low-privileged wiki account uses the TemplateSandbox preview feature to craft template/wikitext input containing an unneutralized script payload, then lures another logged-in user (e.g., a reviewer) to open the crafted sandbox preview. When the victim's browser renders the page, the injected script executes in the wiki origin, enabling actions such as session/token theft or actions on the victim's behalf. No public proof-of-concept is available at time of analysis.