CVE-2025-11261: 
NixOS vulnerability analysis and mitigation

CVE-2025-11261 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation's MediaWiki platform, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw is associated with the JavaScript file resources/src/mediawiki.Language/mediawiki.Language.js and affects all MediaWiki versions before 1.39.15, versions 1.43.0 through 1.43.4, and versions 1.44.0 through 1.44.1. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability stems from insufficient input sanitization within the mediawiki.Language.js client-side JavaScript module, allowing malicious input to be reflected or processed in a way that enables script injection into web pages (CWE-79). The attack vector is network-based, requires no privileges, but does require user interaction — consistent with a reflected or DOM-based XSS pattern. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's security domain. References to the upstream issue tracker entries T406322 and T402077 on Wikimedia's Phabricator provide additional context on the flaw (Red Hat Advisory).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser session on a MediaWiki instance, leading to limited confidentiality and integrity impacts such as session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. Because the scope is changed, the injected script may affect browser resources or data outside the immediate MediaWiki origin. Availability is not impacted by this vulnerability (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-11261. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Red Hat Advisory).

Wikimedia Foundation has released patched versions of MediaWiki that address this vulnerability: 1.39.15, 1.43.5, and 1.44.2. Administrators should upgrade their MediaWiki installations to one of these fixed versions as soon as possible. No specific configuration-based workarounds have been publicly documented; upgrading is the recommended remediation (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux distribution security channels, including Debian LTS and Mageia advisories, as well as Tenable Nessus plugin updates. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution-level patch announcements (Debian LTS Announce, Debian Security Announce).