CVE-2026-58031
published 2026-07-01CVE-2026-58031: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability…
PriorityP423medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.13%
3.2th percentile
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mediawiki | mediawiki | — | — |
| wikimedia_foundation | mediawiki | >= 1.46.0-rc.0 < 1.46.0 | 1.46.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv4.00.0NONECVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.6NONE
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
vendor_redhat·2026-07-01·CVSS 4.6
CVE-2026-58031 [NONE] CWE-79 MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
A flaw was found in Wikimedia Foundation MediaWiki. This vulnerability, categorized as an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting or XSS), allows a remote attacker to inject malicious scripts into web pages. When a user views an affected page, the attacker's script can execute in their browser, potentially leading to information disclosure, session hijacking, or defacement of the website.
Statement: Moderate: A cross-site scripting (XSS) vulnerability in MediaWiki allows a remote attacker to inject malicious scripts into web pages. When a user views an affected page, the attacker's script can execute in their browser, potentially leading to information d
GHSA
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
ghsa_unreviewed·2026-07-01
CVE-2026-58031 [LOW] CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58031 mediawiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization [fedora-all]
bugzilla·2026-07-01
CVE-2026-58031 [NONE] CVE-2026-58031 mediawiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization [fedora-all]
CVE-2026-58031 mediawiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
Bugzilla
CVE-2026-58031 MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
bugzilla·2026-07-01
CVE-2026-58031 [NONE] CVE-2026-58031 MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
CVE-2026-58031 MediaWiki: MediaWiki: Cross-site scripting vulnerability due to improper input neutralization
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js.
This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
2026-07-01
Published