Filing as a security task since none of the three other tasks are public yet.

CommentParser::doWikiLinks currently uses a regex pattern to find and replace wikilink syntax with HTML links. Because of this, it is/was possible to perform XSS in three cases by getting CommentParser::doSectionLinks to return HTML that would be safe on its own, but is not safe for usage in doWikiLinks:

• {T406664}
• T409737: CVE-2026-22710: Stored XSS through autocomment system messages in Wikibase
• T411144: CVE-2026-22713: Stored XSS through edit summaries in GrowthExperiments

In the last two cases, the "unsafe" HTML was produced by the MW parser. As a developer without knowledge of the internal working of CommentParser, I would probably expect parsed HTML to be safe for usage in any HTML sink, but $comment in the FormatAutocomments hook (or specifically doWikiLinks) is not a safe HTML sink.
To reduce the likelihood of similar vulnerabilities being introduced in the future, I think that CommentParser::doWikiLinks should be hardened so it can operate on any safe HTML string without allowing for XSS. This would have prevented all three aforementioned vulnerabilities.