- restore https://www.wikidata.org/w/index.php?title=Q13406268&oldid=1076235008, which has en label "<p onmouseover=alert(1)>1</p>"
- in Commons search box, type "<p" or "Q13406268"
- now you will find the autocomplete suggestion is exposed.
|Resolved||Reedy||T240392 Release MediaWiki 1.31.7/1.33.3/1.34.1|
|Resolved||sbassett||T240400 Write and send supplementary release announcement for extensions and skins with security patches (MediaWiki 1.31.7/1.33.3/1.34.1)|
|Resolved||matthiasmullie||T240773 Exposed HTML in WikibaseMediaInfo autocomplete suggestions (CVE-2020-6163)|
So it doesn't look like templates/search/PropertySuggestionsWidget.mustache+dom existed in REL1_34 or previous, so no backports necessary. I'm going make the task public now and request a CVE.