CVE-2025-67481: 
NixOS vulnerability analysis and mitigation

CVE-2025-67481 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation's MediaWiki platform, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw resides in the mediawiki.JqueryMsg.js file located at resources/src/mediawiki.JqueryMsg/. It affects MediaWiki versions before 1.39.16, 1.43.0–1.43.5 (before 1.43.6), 1.44.0–1.44.2 (before 1.44.3), and version 1.45.0 (before 1.45.1). The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is rooted in insufficient input sanitization within the mediawiki.JqueryMsg.js JavaScript library, which is responsible for parsing and rendering i18n (internationalization) messages in MediaWiki's front-end. An attacker with high privileges can craft malicious message content that, when processed by the JqueryMsg parser, results in unsanitized script injection into the rendered web page (CWE-79). The attack vector is network-based, requires no special attack complexity, but does require high privileges and a changed scope, meaning the injected script can affect users other than the attacker (Red Hat Advisory, Red Hat Bugzilla). A related Wikimedia Phabricator task (T251032) is referenced in the ENISA advisory.

Successful exploitation of this vulnerability could allow a high-privileged attacker to inject malicious JavaScript into MediaWiki pages viewed by other users, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of victims, or data exfiltration within the MediaWiki environment. The scope is changed, meaning the impact extends beyond the attacker's own session to affect other authenticated or unauthenticated users browsing the affected wiki. Availability is not directly impacted, but confidentiality and integrity are both assessed as low impact per the CVSS scoring (Red Hat Advisory).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported as of the time of publication (Red Hat Advisory). The EPSS score is extremely low at approximately 0.018%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as "Unreported," further supporting the absence of known active exploitation.

Wikimedia Foundation has released patched versions addressing this vulnerability. Administrators should upgrade MediaWiki to version 1.39.16, 1.43.6, 1.44.3, or 1.45.1 (or later) as appropriate for their deployment branch (Red Hat Advisory, Red Hat Bugzilla). Debian has also issued a security advisory (DSA-6085-1) and a Debian LTS announcement (DLA-4428-1) for affected packages. As a complementary measure, implementing Content Security Policy (CSP) headers can reduce the impact of any XSS exploitation. Restricting high-privilege access to trusted administrators only further limits the attack surface.

Debian issued a security advisory (DSA-6085-1) and a long-term support announcement (DLA-4428-1) addressing this and related MediaWiki vulnerabilities, indicating broad downstream distribution concern. Tenable published Nessus detection plugins (IDs 278372 and 279440) to assist organizations in identifying vulnerable MediaWiki installations. No significant researcher commentary or social media discussion has been observed beyond standard vulnerability tracking and distribution channels.