A security vulnerability has been discovered in MediaWiki setups which use both Wikibase and MobileFrontend.
All projects in the Wikimedia cluster have been since patched but if you use these two extensions please be sure to apply the fix.
Patch file and issue are documented on https://phabricator.wikimedia.org/T125684