CVE-2025-61646: 
NixOS vulnerability analysis and mitigation

CVE-2025-61646 is a cross-site scripting (XSS) and information disclosure vulnerability in Wikimedia Foundation's MediaWiki, specifically within the includes/RecentChanges/EnhancedChangesList.php component. It affects MediaWiki versions before 1.39.14, 1.43.0–1.43.3 (before 1.43.4), and 1.44.0 (before 1.44.1). The vulnerability was published on February 3, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 1.2 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) and CWE-22 (Path Traversal), and manifests as a cross-site scripting flaw in MediaWiki's Enhanced Recent Changes list display (EnhancedChangesList.php). An authenticated attacker with low privileges can inject malicious scripts that are rendered when other users view the Recent Changes page, requiring passive user interaction to trigger. The attack vector is network-based with low complexity and no special attack requirements, but exploitation depends on a victim user viewing the affected page (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to inject malicious scripts into the Recent Changes view, potentially exposing limited confidential information (low confidentiality impact) and performing unauthorized actions in the context of the victim's browser session (low integrity impact). There is no direct availability impact. The scope is changed, meaning the injected script can affect users beyond the attacker's own session, though the overall severity remains moderate due to the requirement for user interaction (Red Hat Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-61646. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The CVSSv4 exploit maturity is rated as "Unreported," and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user account and passive interaction from a victim viewing the Recent Changes page (Red Hat Advisory).

1. Obtain authenticated access: Register or log in to a MediaWiki instance running a vulnerable version (before 1.39.14, 1.43.4, or 1.44.1) with at least a low-privileged user account.
2. Craft a malicious edit or action: Create or modify a wiki page or perform an action that injects a malicious script payload into fields rendered by EnhancedChangesList.php in the Recent Changes display.
3. Wait for victim interaction: The injected payload is stored or reflected in the Enhanced Recent Changes list; when another authenticated user views the Recent Changes page, their browser executes the malicious script.
4. Achieve objective: The executed script can steal session cookies, exfiltrate limited user information, or perform actions on behalf of the victim within the MediaWiki instance (Red Hat Advisory, Red Hat Bugzilla).

• Logs: MediaWiki access logs showing unusual or encoded script content in parameters associated with Recent Changes page requests; unexpected JavaScript payloads in edit summaries or page titles visible in Special:RecentChanges.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after viewing the Recent Changes page; unusual POST requests carrying session tokens to external hosts.
• File System: No direct file system artifacts expected for a reflected/stored XSS; however, review MediaWiki database entries in the recentchanges table for unexpected script tags or encoded payloads in edit summaries or associated fields.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to one of these versions as the primary remediation. Debian LTS and stable security updates have also been issued (DLA-4355-1 and DSA-6085-1) for distributions packaging MediaWiki. No specific configuration-based workaround has been publicly documented; upgrading is the recommended action (Red Hat Advisory, Debian LTS Announce, Debian Security Announce).

Red Hat has tracked this vulnerability at low severity in their Bugzilla system, and Debian has issued security advisories (DLA-4355-1 and DSA-6085-1) for their MediaWiki packages. Tenable has published Nessus detection plugins for this CVE. No significant researcher commentary or broad media coverage has been identified beyond standard vulnerability tracking and distribution-level advisories (Red Hat Bugzilla, Debian LTS Announce).