CVE-2025-6591: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-6591 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically associated with the includes/api/ApiFeedContributions.php file. It affects MediaWiki versions before 1.39.13, 1.42.7, 1.43.2, and 1.44.0. The vulnerability was published on February 2, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium), with a changed scope indicating cross-boundary impact (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), rooted in insufficient input sanitization within the ApiFeedContributions.php API endpoint. An unauthenticated remote attacker can craft a malicious request that, when a victim user interacts with it (e.g., clicks a link), causes the browser to execute injected JavaScript in the context of the MediaWiki site. The attack requires no special privileges from the attacker but does require active user interaction, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation could allow an attacker to inject malicious scripts into pages served by the MediaWiki instance, potentially stealing session tokens, redirecting users to malicious sites, defacing wiki content, or performing unauthorized actions on behalf of authenticated users. The confidentiality impact is low (limited information disclosure such as session tokens), while integrity and availability are not directly impacted by the XSS itself. The changed scope means the attack can affect browser-side resources beyond the vulnerable endpoint (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must follow a crafted link or visit a malicious page), which further limits opportunistic exploitation (Red Hat Advisory).

1. Reconnaissance: Identify publicly accessible MediaWiki installations running versions prior to 1.39.13, 1.42.7, 1.43.2, or 1.44.0 using search engines, Shodan, or manual version checks via the MediaWiki API (/api.php?action=query&meta=siteinfo).
2. Craft malicious payload: Construct a URL targeting the ApiFeedContributions API endpoint (/api.php?action=feedcontributions&...) with an XSS payload embedded in a vulnerable parameter that is reflected or stored without proper sanitization.
3. Deliver the payload: Send the crafted URL to a target user via phishing email, social engineering, or by embedding it in a page the victim is likely to visit.
4. Trigger execution: When the victim clicks the link and their browser processes the response from the vulnerable endpoint, the injected JavaScript executes in the context of the MediaWiki site.
5. Achieve objective: The attacker's script can steal the victim's session cookie, exfiltrate CSRF tokens, redirect the user to a phishing site, or perform wiki actions (edits, account changes) on behalf of the victim (Red Hat Advisory).

• Network: Unusual or malformed HTTP requests to /api.php?action=feedcontributions containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in query parameters; unexpected outbound connections from user browsers to attacker-controlled domains following interaction with MediaWiki pages.
• Logs: MediaWiki access logs showing requests to the feedcontributions API endpoint with anomalous or URL-encoded characters in parameter values; repeated requests from the same IP with varying payload patterns.
• File System: No direct file system artifacts expected for a reflected XSS; however, if the XSS is used to deliver a credential-harvesting payload, check for unexpected new user accounts or privilege escalations in the MediaWiki database.
• Process/Application: Unexpected JavaScript-driven actions in MediaWiki audit logs (e.g., edits, account changes) attributed to legitimate users at unusual times, potentially indicating session hijacking.

Administrators should upgrade MediaWiki to one of the patched versions: 1.39.13, 1.42.7, 1.43.2, or 1.44.0 (or later), depending on the currently deployed branch. As a temporary workaround where immediate patching is not feasible, consider implementing strict Content Security Policy (CSP) headers to limit script execution, restricting access to the ApiFeedContributions API endpoint, and monitoring logs for suspicious activity. Debian users should apply the DSA-5957-1 security update, and Debian LTS users should apply DLA-4249-1 (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux distribution security channels, including Debian security announcements (DSA-5957-1 and DLA-4249-1) and aggregator sites such as LinuxSecurity.com and LinuxCompatible.org. Vulnerability scanning vendors Tenable (Nessus) and Qualys added detection plugins for the CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard advisory distribution.