CVE-2020-27957: 
NixOS vulnerability analysis and mitigation

The RandomGameUnit extension for MediaWiki through version 1.35 contained a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-27957. The vulnerability was discovered on October 25, 2020, and was caused by improper escaping of various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension (Phabricator, CVE).

The vulnerability existed due to missing htmlspecialchars() calls in the extension's callback functions. When user-generated input from the database containing malicious code was not properly sanitized before being displayed back to users, it allowed stored XSS attacks. This affected multiple game types including PictureGame, PollNY, and QuizGame since RandomGameUnit failed to properly escape titles and options for all three types of games (Phabricator).

The vulnerability allowed attackers to execute arbitrary JavaScript code in victims' browsers by creating games with maliciously crafted titles. When using RandomGameUnit, either directly via adding the parser tag to a wiki page or as a fixed part of the UI (e.g., in the Nimbus skin), the malicious code would be executed in the context of other users' browsers (Phabricator).

The vulnerability could be exploited by creating a game (such as a picture game via Special:PictureGameHome) with a title containing JavaScript code like alert('XSS'). The malicious code would then be stored in the database and executed whenever the game was displayed through RandomGameUnit (Phabricator).

The vulnerability was fixed by adding proper htmlspecialchars() calls to all three callback functions to ensure that user-generated content stored in the database is properly sanitized before being displayed. The fix was implemented in patch 69bcc1ae9f82 and backported to affected versions (Phabricator).