CVE-2026-58035 Wikimedia Foundation CVE debrief

Who should care

Users of MediaWiki, especially those with publicly accessible deployments, should be aware of this vulnerability and take steps to verify their exposure and apply patches or mitigations as needed. This includes MediaWiki administrators, security teams, and operators responsible for maintaining wiki instances.

Technical summary

CVE-2026-58035 is an Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in MediaWiki. The vulnerability has a CVSS score of null and a severity of NONE. It is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users of the affected MediaWiki deployments. Affected users should review and apply vendor patches to mitigate this vulnerability.

Defensive priority

Medium priority due to limited information available on affected versions and configurations.

Recommended defensive actions

• Review and apply vendor patches
• Monitor for suspicious activity
• Implement compensating controls
• Verify affected MediaWiki deployments exist in managed environments
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

CVE-2026-58035 is an Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in MediaWiki. Evidence is limited; verify affected scope and vendor remediation. Limited information available on affected versions and configurations. Defenders should verify MediaWiki deployments and review vendor advisories for patching guidance.

Official resources