Page MenuHomePhabricator

CVE-2025-32073: System message XSS in HTMLTags
Closed, ResolvedPublicSecurity

Description

https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/HTMLTags/+/aff6f56c8b555df262bad4e88dd60645e2848154/includes/HTMLTags.php#31

This returns the ~literal contents of the system message "htmltags-notagname", and the return value of the tag function is interpreted as raw HTML.

Details

Author Affiliation
Wikimedia Communities

Event Timeline

@Yaron_Koren: https://www.mediawiki.org/wiki/Extension:HTML_Tags does not list where to report issues. If you'd like to use Wikimedia Phabricator to track issues in this extension, could you please request a dedicated project tag and watch it afterwards, so folks don't have to manually look up maintainer(s) on the wiki page and manually CC them on tickets? Thanks a lot! :)

We have to subscribe them to security tasks anyway because of the default view policy

If an owner/maintainer is found who wishes to submit a patch, this should just go directly through gerrit.

@Yaron_Koren: https://www.mediawiki.org/wiki/Extension:HTML_Tags does not list where to report issues. If you'd like to use Wikimedia Phabricator to track issues in this extension, could you please request a dedicated project tag and watch it afterwards, so folks don't have to manually look up maintainer(s) on the wiki page and manually CC them on tickets? Thanks a lot!

Mstyles renamed this task from System message XSS in HTMLTags to CVE-2025-32073: System message XSS in HTMLTags.Apr 11 2025, 5:05 PM
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".