CVE-2025-67484: 
NixOS vulnerability analysis and mitigation

CVE-2025-67484 is a Cross-Site Scripting (XSS) and improper input validation vulnerability in Wikimedia Foundation MediaWiki, specifically within the includes/Api/ApiFormatXml.php file. It affects MediaWiki versions before 1.39.16, 1.43.6, 1.44.3, and 1.45.1. The vulnerability was published on February 3, 2026, and is tracked by the Wikimedia Foundation as the assigning CNA. It carries a CVSS v3.1 base score of 9.8 (Critical), though the CVSS v4.0 assessment reflects a lower practical severity due to the high-privilege requirement noted in that scoring context (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is rooted in improper neutralization of input during web page generation (CWE-79, Cross-Site Scripting) and improper input validation (CWE-20) within MediaWiki's XML API formatter (ApiFormatXml.php). The attack vector is network-accessible, requiring no user interaction under the CVSS v3.1 assessment, and involves insufficient sanitization of user-supplied data processed through the XML formatting API endpoint. The Wikimedia Foundation's Phabricator task T401995 is referenced as the upstream tracking issue (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation could compromise the confidentiality, integrity, and availability of affected MediaWiki installations. An attacker could leverage the XSS vulnerability to steal session tokens, perform actions on behalf of authenticated users (including administrators), inject malicious content, or potentially escalate access within the wiki environment. The input validation bypass may further enable unauthorized data access or modification (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploit maturity is rated as "Unreported" in the CVSS v4.0 assessment (Red Hat Advisory).

Organizations should upgrade affected MediaWiki installations to the patched versions: 1.39.16, 1.43.6, 1.44.3, or 1.45.1. As interim measures, administrators should review and restrict high-privilege account access, monitor XML API activity for anomalous requests, and ensure proper input validation controls are enforced at the application or WAF layer. Debian has also issued security advisories (DSA-6085-1 and DLA-4428-1) for downstream package updates (Red Hat Advisory, Debian Security Announce, Debian LTS Announce).

Debian issued security advisories for both stable (DSA-6085-1) and long-term support (DLA-4428-1) releases of MediaWiki addressing this and related CVEs. Tenable published Nessus detection plugins (IDs 278370 and 279440) to identify vulnerable installations. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability tracking and downstream package updates (Debian Security Announce, Debian LTS Announce).