CVE-2025-61638: 
NixOS vulnerability analysis and mitigation

CVE-2025-61638 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki and Parsoid, caused by improper neutralization of input during web page generation. The flaw resides in the sanitizer components (includes/parser/Sanitizer.php in MediaWiki and src/Core/Sanitizer.php in Parsoid). Affected versions include MediaWiki before 1.39.14, 1.43.4, and 1.44.1, and Parsoid before 0.16.6, 0.20.4, and 0.21.1. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Red Hat Bugzilla, Red Hat Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically within the Sanitizer.php files used by both MediaWiki and Parsoid to process and sanitize user-supplied wiki markup and HTML attributes. An attacker with high privileges (e.g., a wiki editor) can craft malicious input that bypasses the sanitizer's attribute validation logic, injecting JavaScript that executes in the browsers of users who view the affected page. Exploitation requires user interaction (a victim must load the page containing the injected payload) and the scope is changed, meaning the injected script executes in the context of the victim's browser session on the wiki domain. A proof-of-concept exploit has been published on GitHub (PoC GitHub, Infinitsec Blog).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browsers of users visiting affected wiki pages, enabling session hijacking, credential theft, malware distribution, or defacement of wiki content. The changed scope means the impact extends beyond the attacker's own session to any user who views the compromised page. Confidentiality and integrity are both partially impacted (low), while availability is not directly affected (Red Hat Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available on GitHub (PoC GitHub), added to Feedly's exploit tracking on March 2, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs 269511, 272096, 279440) and Qualys (ID 6271328) (Red Hat Advisory).

1. Reconnaissance: Identify a target MediaWiki or Parsoid instance running a vulnerable version (MediaWiki < 1.39.14, < 1.43.4, or < 1.44.1; Parsoid < 0.16.6, < 0.20.4, or < 0.21.1) by checking the wiki's Special:Version page or HTTP response headers.
2. Obtain editing privileges: Log in to the wiki with an account that has page editing rights (the vulnerability requires high privileges per the CVSS vector).
3. Craft malicious payload: Construct a wiki markup or HTML snippet containing a specially crafted attribute value (e.g., a data-* attribute or similar) that bypasses the Sanitizer::validateAttributes() function in Sanitizer.php, embedding a JavaScript payload such as <tag data-x="javascript:alert(document.cookie)">.
4. Inject payload: Edit a wiki page and insert the crafted markup, then save the page. The sanitizer fails to strip or encode the malicious attribute, persisting the payload in the page content.
5. Trigger execution: When another user (e.g., an administrator or regular visitor) views the affected page, their browser renders the injected markup and executes the JavaScript payload in the context of the wiki domain.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, redirect to phishing pages, or exfiltrate sensitive data (PoC GitHub, Infinitsec Blog).

• Logs: MediaWiki access logs showing POST requests to index.php?action=submit or API edit endpoints containing unusual data-* attributes or encoded JavaScript strings in page content fields; MediaWiki revision history entries with suspicious HTML attribute patterns in recently edited pages.
• File System: Unexpected modifications to wiki page content containing JavaScript URIs or event handler attributes (e.g., javascript:, onerror=, onload=) that survived sanitization.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after viewing specific wiki pages; unusual JavaScript-initiated HTTP requests originating from the wiki's domain in browser network logs.
• Application: Wiki revision history showing edits by privileged accounts inserting HTML with unsanitized data-* or other attribute values containing script content (Red Hat Advisory, Infinitsec Blog).

Wikimedia Foundation has released patched versions addressing this vulnerability. Administrators should upgrade to MediaWiki 1.39.14, 1.43.4, or 1.44.1 (or later), and Parsoid 0.16.6, 0.20.4, or 0.21.1 (or later). As interim mitigations, restrict wiki editing permissions to trusted users only, implement Content Security Policy (CSP) headers to limit the impact of any successful XSS, and monitor wiki revision histories for suspicious attribute injection. Debian LTS and Mageia have also released updated packages for their respective distributions (Red Hat Bugzilla, Debian LTS, Debian Security).

A technical blog post by a MediaWiki developer (bawolff.net) discussed the XSS protector's effectiveness in the context of this and related vulnerabilities, providing community insight into the sanitizer's design limitations (bawolff Blog). Debian issued both an LTS advisory (DLA-4355-1) and a security announcement (DSA-6085-1) for MediaWiki, and Mageia published MGASA-2025-0260, reflecting broad downstream distribution response. No significant social media controversy or major vendor statements beyond standard patch advisories have been observed.