CVE-2025-6594: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-6594 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically within the API Sandbox component (resources/src/mediawiki.Special.Apisandbox/ApiSandbox.js). It affects MediaWiki versions from 1.27.0 before 1.39.13, 1.42.7 before 1.43.2, and 1.44.0. The vulnerability was publicly disclosed on February 2, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), rooted in insufficient sanitization of user-supplied input within the ApiSandbox.js file of MediaWiki's Special:ApiSandbox interface. An unauthenticated remote attacker can craft malicious input that, when rendered in the API Sandbox page, executes arbitrary JavaScript in the victim's browser context. Exploitation requires passive user interaction — a user must visit or interact with the affected API Sandbox page while the malicious content is present. The attack vector is network-based with low complexity and no authentication required (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute malicious scripts in the browser context of any user who interacts with the affected API Sandbox interface, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The confidentiality impact is limited (low) with no direct integrity or availability impact on the server, but the changed scope means the attack can affect resources beyond the vulnerable component itself. The vulnerability is particularly relevant for MediaWiki deployments where the API Sandbox is accessible to a broad user base (Red Hat Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.0001 (0.01%), reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 6264870) and Tenable Nessus (IDs: 241337, 242647, 243630) (Red Hat Advisory).

1. Reconnaissance: Identify publicly accessible MediaWiki instances running versions 1.27.0–1.39.12, 1.42.7–1.43.1, or 1.44.0 using web search or scanning tools. Confirm the Special:ApiSandbox page is accessible.
2. Craft malicious payload: Prepare an XSS payload targeting the unvalidated input field(s) within the API Sandbox interface (Special:ApiSandbox), leveraging the lack of proper input neutralization in ApiSandbox.js.
3. Deliver the payload: Inject the malicious script via the vulnerable input parameter in the API Sandbox. This may involve crafting a URL or form submission that embeds the payload.
4. Trigger victim interaction: Lure a target user (e.g., an administrator or logged-in user) to visit the API Sandbox page containing the injected payload, either through social engineering or by exploiting stored XSS if the payload persists.
5. Achieve objective: The injected script executes in the victim's browser, enabling session token theft, credential harvesting, or performing actions on behalf of the victim within the MediaWiki instance (Red Hat Advisory).

• Network: Unusual or unexpected HTTP requests to Special:ApiSandbox containing encoded JavaScript payloads (e.g., <script>, onerror=, javascript: URI schemes) in query parameters or POST body.
• Logs: MediaWiki access logs showing requests to the API Sandbox endpoint with anomalous or encoded input strings; repeated access from unfamiliar IP addresses to the ApiSandbox page.
• Browser/Client-Side: Users reporting unexpected redirects, pop-ups, or session invalidation after visiting the API Sandbox page.
• File System: Unexpected modifications to resources/src/mediawiki.Special.Apisandbox/ApiSandbox.js if an attacker has achieved further access (Red Hat Advisory).

Wikimedia Foundation has released patched versions: MediaWiki 1.39.13, 1.43.2, and 1.44.1 or later. Administrators should upgrade affected installations to the appropriate patched version as the primary remediation. As a temporary workaround, restrict access to the Special:ApiSandbox page to trusted administrators only. Additionally, implementing Content Security Policy (CSP) headers can reduce the impact of any successful XSS exploitation. Debian has also issued security advisories (DSA-5957-1 and DLA-4249-1) for affected packages (Red Hat Advisory, Debian Advisory).

Debian issued security advisory DSA-5957-1 and a Long Term Support advisory DLA-4249-1 addressing this and related MediaWiki vulnerabilities, indicating broad distribution-level attention (Debian Advisory, Debian LTS). Red Hat tracked the issue via Bugzilla and assigned it high priority and severity (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.