CVE-2025-67482: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-67482 is a sandbox bypass vulnerability in Wikimedia Foundation's Scribunto extension and luasandbox library, affecting MediaWiki installations. The flaw is associated with the files includes/Engines/LuaCommon/lualib/mwInit.Lua and library.C, and allows Lua scripts to execute outside their intended security constraints. Affected versions include Scribunto before 1.39.16, 1.43.6, 1.44.3, and 1.45.1, and luasandbox before commit fea2304f8f6ab30314369a612f4f5b165e68e95a. It carries a CVSS v4.0 base score of 1.7 (Low), though the broader impact on wiki content integrity may be more significant in practice (Red Hat CVE, EUVD).

The vulnerability stems from insufficient sandboxing enforcement in the Lua execution environment used by the Scribunto MediaWiki extension. Specifically, weaknesses in mwInit.Lua and the C-level library.C allow crafted Lua scripts to escape the sandbox and execute code outside the intended security boundaries (CWE classification not formally assigned, but consistent with sandbox escape/improper isolation). The attack vector is network-based, requires no privileges or user interaction, but does require specific attack conditions to be present (AT:P in CVSS 4.0 terms), making exploitation non-trivial. The Wikimedia Foundation's Phabricator task T408135 tracks the underlying issue (Red Hat CVE).

Successful exploitation could allow an attacker to execute arbitrary Lua code outside the sandbox within a MediaWiki wiki environment, potentially compromising content integrity and enabling privilege escalation within the wiki platform. The availability impact is rated Low, with no direct confidentiality or integrity impact at the system level per the CVSS scoring, though wiki content and configurations could be manipulated. Lateral movement beyond the wiki environment is unlikely given the constrained execution context, but abuse of wiki administrative functions post-exploitation is a concern (Red Hat CVE, EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67482. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploit maturity is classified as "Unreported" per CVSS 4.0 metadata, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The requirement for specific attack conditions (AT:P) further reduces the practical exploitability of this flaw (Red Hat CVE).

Wikimedia Foundation has released patched versions addressing this vulnerability: Scribunto 1.39.16, 1.43.6, 1.44.3, and 1.45.1, and luasandbox at or after commit fea2304f8f6ab30314369a612f4f5b165e68e95a. Debian has also issued security advisories (DSA-6085-1 and DLA-4428-1) for MediaWiki packages incorporating these fixes. Administrators running affected MediaWiki installations should upgrade the Scribunto extension and luasandbox library to the patched versions as soon as possible (Debian Security Announce, Debian LTS Announce, Red Hat CVE).

The vulnerability received standard coverage from Linux distribution security channels, with Debian issuing advisories for both stable (DSA-6085-1) and LTS (DLA-4428-1) releases. Tenable published Nessus detection plugins (IDs 278543 and 279440) for the affected packages. No notable researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking (Debian Security Announce, Tenable Nessus).