@Rscout For GHSA-4h5r-8rjm-496r, the Description seems to be wrong.

We need to keep this issue private until the next core mediawiki security release, due out at the end of September 2025. I've subscribed #acl_release_security_pre_announce to this task for external operators to patch early if they so choose. @Reedy, who manages the core mediawiki security releases, can decide if a special supplemental announcement regarding this issue should accompany the core mediawiki security release.

Should we also prepare an FAQ similar to the 2021-12 security release/FAQ?

Based on Reporting security bugs, do we need a CVE?

Added some friends who already knew and may be able to help with this vulnerability, since I assumed it was just an extension vulnerability.

FYI: XSS Filter Evasion Cheat Sheet

Since I was the one who actually discovered this, please reopen this ticket and close the other one.