Loading JS from user space where the username is not a registered account is dangerous and should be banned

PKSA-qc4c-7cdq-417d CVE-2019-12471

Affected package: mediawiki/core

Affected version: >=1.27.0,<1.27.6|>=1.30.0,<1.30.2|>=1.31.0,<1.31.2

Reported by:
FriendsOfPHP/security-advisories