CVE-2025-67483: 
NixOS vulnerability analysis and mitigation

CVE-2025-67483 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki, specifically within the page preview functionality. The flaw resides in the JavaScript file resources/src/mediawiki.Page.Preview.Js and stems from improper neutralization of input during web page generation. It affects MediaWiki versions prior to 1.43.6, 1.44.3, and 1.45.1. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The flaw exists in the client-side JavaScript file resources/src/mediawiki.Page.Preview.Js, which handles page preview rendering in MediaWiki. Insufficient sanitization of user-supplied input allows malicious script content to be injected and executed in the context of a victim's browser when they interact with the page preview feature. The attack vector is network-based, requires no authentication, but does require user interaction to trigger (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim user's browser session on the affected MediaWiki instance. This may lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or manipulation of page content. The confidentiality and integrity impacts are both rated Low, with no availability impact, and the scope is changed — meaning the attack can affect resources beyond the vulnerable component itself (Red Hat Advisory).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-67483. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must visit or interact with a crafted page preview), which further limits the practical attack surface (Red Hat Advisory).

1. Identify a vulnerable MediaWiki instance: Confirm the target is running MediaWiki versions prior to 1.43.6, 1.44.3, or 1.45.1 with the page preview feature enabled.
2. Craft malicious wiki content: Create or edit a wiki page to include content containing an XSS payload that exploits insufficient input sanitization in the page preview JavaScript (mediawiki.Page.Preview.Js).
3. Trigger the page preview: Induce a victim user (e.g., via a shared link or social engineering) to open the page preview for the crafted content, causing the malicious script to execute in their browser.
4. Achieve objective: The injected script executes in the victim's browser session, potentially stealing session cookies, performing actions on behalf of the user, or exfiltrating sensitive data from the MediaWiki instance (Red Hat Advisory, Red Hat Bugzilla).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains originating from MediaWiki page preview interactions; unusual JavaScript-initiated requests (e.g., to attacker-controlled endpoints) in browser network logs.
• Logs: MediaWiki access logs showing repeated or unusual requests to page preview endpoints (action=preview or similar) with anomalous or encoded content in POST bodies.
• File System: Unexpected modifications to wiki page content containing encoded script tags or JavaScript event handlers, particularly in pages that have been recently edited.
• Process/Browser: Browser developer console errors or unexpected script execution events triggered during MediaWiki page preview interactions.

Wikimedia Foundation has released patched versions of MediaWiki that address this vulnerability. Administrators should upgrade to MediaWiki 1.43.6, 1.44.3, or 1.45.1 (or later) as soon as possible. As interim mitigations, deploying a Web Application Firewall (WAF) with XSS detection rules and restricting edit permissions to trusted users can reduce exposure. Disabling the page preview feature until patching is feasible may also limit the attack surface (Red Hat Advisory, Debian Advisory).

The vulnerability was tracked by Red Hat's Product Security team and assigned a low severity rating in their Bugzilla system. Debian issued a security advisory (DSA-6085-1) covering MediaWiki updates that include the fix for this CVE. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Red Hat Bugzilla, Debian Advisory).