CVE-2026-58032: MediaWiki XSS Vulnerability in API Module – Patch Guidance

Technical summary

CVE-2026-58032 is an improper input neutralization vulnerability (CWE-79) located in the MediaWiki API module at resources/src/mediawiki.Api/index.js. The flaw permits reflected or stored cross-site scripting attacks because user-supplied input is not adequately sanitized before being rendered into dynamically generated web pages. The vulnerability requires user interaction (a click or navigation) to trigger, operates across network boundaries, and does not require authentication. The injected script executes in the same origin context as the MediaWiki application, granting access to sensitive operations and data visible to the authenticated user.

Business impact

Organizations running MediaWiki instances face a moderate but meaningful risk. A successful attack could compromise user accounts, exfiltrate sensitive wiki content, modify pages without audit trails, or launch further attacks against the organization's network using the compromised session. Public-facing wikis are at higher risk because attackers can reach a broader audience. Internal wikis are exposed if an attacker can craft a convincing phishing link or compromise a trusted communication channel to distribute the malicious URL.

Affected systems

MediaWiki versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected. Any deployment running these older versions is vulnerable, including wikis using long-term support (LTS) branches if not patched to the specified maintenance releases.

Exploitability

Exploitability is moderate. The attack vector is network-based with low complexity, meaning no special network access or privileged position is required. However, the vulnerability requires user interaction—the victim must click a malicious link or be socially engineered into visiting a crafted page. There is no evidence this vulnerability is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public working exploits have been widely disclosed at this time. Nevertheless, the attack surface is significant for public wikis and wikis used in phishing-susceptible organizations.

Remediation

Update MediaWiki to one of the patched versions: 1.46.0 or later, or the corresponding maintenance releases (1.45.4, 1.44.6, 1.43.9 or later in those branches). Organizations unable to update immediately should implement Web Application Firewall (WAF) rules to detect and block suspicious JavaScript patterns in query parameters and POST data, and consider temporarily restricting public access to the wiki or requiring additional authentication steps.

Patch guidance

Review the Wikimedia Foundation security advisory for your specific MediaWiki branch. Apply the appropriate patched version as soon as practical: verify compatibility with any custom extensions before deployment. Test in a non-production environment first, as MediaWiki updates can interact with third-party extensions. If you are on an LTS release, ensure you are moving to the patched maintenance version within your branch (e.g., 1.45.4 for the 1.45 series) rather than jumping major versions unnecessarily. Document the update in your change management system.

Detection guidance

Monitor web server and MediaWiki logs for suspicious query parameters or POST payloads containing script tags, event handlers (onclick, onerror, etc.), or encoded JavaScript. Implement input validation logging at your WAF or API gateway layer. Use security scanning tools to inspect pages for reflected XSS vectors in the API module. Conduct user awareness training to reduce the likelihood of users clicking malicious links in emails or chat messages that target your wiki.

Why prioritize this

Although this vulnerability has a CVSS score of 6.1 (MEDIUM) and does not yet appear on the CISA KEV catalog, the combination of network accessibility, low attack complexity, and cross-site impact warrants prompt attention. Public wikis and those used for sensitive internal collaboration should prioritize patching within 2–4 weeks. Internal wikis in lower-risk environments may follow a standard patch cycle. The lack of a known public exploit does not guarantee one won't emerge; early patching reduces exposure window.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a MEDIUM severity rating with the following factors: Network-accessible attack vector (AV:N) and no authentication requirement (PR:N) elevate base risk. User interaction is required (UI:R), which reduces exploitability. The impact scope is changed (S:C), affecting resources beyond the vulnerable component—in this case, other users' browser sessions. Confidentiality and integrity impacts are low (C:L, I:L), as attackers gain limited data access and can perform moderate-impact modifications but not system-wide compromise. Availability is not affected (A:N). The score appropriately flags this as a meaningful but not critical threat requiring timely remediation.

Frequently asked questions