CVE-2020-25828: 
PHP vulnerability analysis and mitigation

CVE-2020-25828 is a security vulnerability in MediaWiki that affects the non-jqueryMsg version of mw.message().parse() function. The vulnerability was disclosed on September 24, 2020, as part of MediaWiki's security and maintenance release for versions 1.31.9 and 1.34.3. This vulnerability affects multiple versions of MediaWiki software and could lead to Cross-Site Scripting (XSS) attacks due to improper HTML escaping (MediaWiki List).

The vulnerability exists in MediaWiki's JavaScript message parsing functionality, specifically in the mediawiki.js component. The issue occurs because the non-jqueryMsg version of mw.message().parse() doesn't properly escape HTML content, which could lead to potential XSS vulnerabilities. The vulnerability is tracked as task T115888 in MediaWiki's issue tracking system (MediaWiki List).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks through unescaped HTML content in message parsing. This could potentially lead to unauthorized access to user data or execution of malicious scripts in users' browsers (MediaWiki List).

The vulnerability requires the ability to input content that would be processed by the affected message parsing function. No specific details about exploitation in the wild have been publicly disclosed (MediaWiki List).

The vulnerability was patched in MediaWiki versions 1.31.9, 1.34.3, and subsequent releases. Users are advised to upgrade to these versions or later. Additionally, a follow-up maintenance release (versions 1.31.10 and 1.34.4) was issued to fix issues with the backports in the initial security release (MediaWiki List).