CVE-2026-58031: MediaWiki API Sandbox XSS Vulnerability (CVSS 5.4)

Technical summary

CVE-2026-58031 is an improper input neutralization vulnerability (CWE-79) located in the ApiSandboxLayout.js resource file within MediaWiki's Special:ApiSandbox interface. The vulnerability allows authenticated attackers to inject arbitrary JavaScript that bypasses output encoding or content security controls. The flaw affects MediaWiki versions from 1.46.0-rc.0 up to (but not including) 1.46.0. With a CVSS 3.1 score of 5.4 (MEDIUM), the vector reflects the requirement for prior authentication and user interaction, though the cross-site nature (S:C) means injected scripts can access content across different security contexts within the same origin.

Business impact

Organizations running vulnerable MediaWiki instances face risk to their API development and documentation workflows. Attackers with edit or API access permissions could plant persistent XSS payloads in sandbox examples or requests, compromising users who test or review those sandboxed API calls. For public wikis with contributor communities, this could damage trust and require incident response. The impact is generally contained to users of that specific wiki instance, though critical wikis (internal developer documentation, public reference sites) may warrant faster remediation.

Affected systems

MediaWiki versions 1.46.0-rc.0 through versions prior to 1.46.0 are affected. This includes release candidates and any production or staging deployments using the 1.46 branch before the final 1.46.0 release. Administrators should check their MediaWiki version via the version file or Special:Version page. Earlier stable branches (1.45, 1.44, etc.) and later releases (1.46.0 and beyond) should be evaluated separately against vendor guidance.

Exploitability

Exploitability is moderate. The vulnerability requires an authenticated account on the MediaWiki instance—ruling out unauthenticated drive-by attacks—and also requires the victim to interact with a specially crafted API sandbox request or example. However, once those prerequisites are met, execution is reliable and does not depend on complex or user-unusual behavior. In collaborative environments where users regularly test API calls, social engineering to click a malicious sandbox link is plausible. The attack does not require elevated privileges; standard contributor status is sufficient.

Remediation

Update MediaWiki to version 1.46.0 or later, which contains the fix for this vulnerability. If you are currently on a 1.46 release candidate, upgrade to the stable 1.46.0 release. For organizations unable to update immediately, consider restricting access to Special:ApiSandbox via user permissions or disabling the feature temporarily if it is not critical to operations. Apply standard web application security practices: ensure Content Security Policy headers are properly configured, maintain up-to-date extensions, and review user permissions regularly.

Patch guidance

Wikimedia Foundation has addressed this vulnerability in MediaWiki 1.46.0. Administrators should obtain the latest stable release from the official MediaWiki download site or their package repository. Verify the integrity of the downloaded software using official checksums. Before deploying to production, test the update in a staging environment to ensure compatibility with existing extensions and configurations. Document the update in your change management system and communicate the security improvement to your team.

Detection guidance

Monitor web server logs for unusual activity targeting Special:ApiSandbox, particularly POST requests with suspicious parameters or script-like payloads in query strings. Review MediaWiki revision history and logs for unexpected edits to API sandbox documentation or example pages, especially insertions of script tags or event handlers. Implement application-level monitoring for JavaScript execution anomalies if your web application firewall supports MediaWiki inspection. Conduct periodic security audits of user accounts with API sandbox modification rights to identify compromised or unauthorized accounts.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), this vulnerability affects the API development workflow—a critical tool for technical teams. Prioritize patching if your organization uses MediaWiki for internal API documentation or if your wiki accepts external contributors. The authentication requirement and user interaction prerequisite lower urgency for closed internal wikis with trusted users, but public or semi-public instances should be updated promptly. The fix is straightforward (a version upgrade), making this a good candidate for near-term patching cycles.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a MEDIUM severity rating due to the combination of factors: network accessibility (AV:N) and low attack complexity (AC:L) support broader attack surface, but the requirement for prior authentication (PR:L) and user interaction (UI:R) significantly constrain practical exploitability. Confidentiality and integrity impacts are low (C:L, I:L) because the attacker operates within the victim's browser context and the affected wiki, not gaining access to backend systems or data beyond what the victim already sees. No availability impact (A:N) is recorded. The cross-site scope (S:C) indicates the payload can escape the direct component and affect the wider application.

Frequently asked questions