CVE-2025-61637: Stored XSS through system messages in MW Core
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	SomeRandomDeveloper
	May 20 2025, 9:26 PM

Project Tags

Referenced Files

	F60349944: T394856.patch
	May 21 2025, 3:01 PM

	F60325286: Core.diff
	May 20 2025, 9:54 PM

	F60324709: image.png
	May 20 2025, 9:26 PM

	F60324684: image.png
	May 20 2025, 9:26 PM

Subscribers

Description

The following system messages in MediaWiki Core are vulnerable to stored XSS:

preview
editlink
viewsourcelink

Reproduction Steps

For all of these messages:

Enable "show preview without reloading the page" at Special:Preferences

preview

Go to /w/index.php?title=PreviewXSS&action=edit&uselang=x-xss (or edit any page while using the x-xss language)
Click the preview button

Cause: https://github.com/wikimedia/mediawiki/blob/32f306882bbe1de578ff9b4c6c74c10906a2d06c/resources/src/mediawiki.action/mediawiki.action.edit.preview.js#L17 and https://gerrit.wikimedia.org/g/mediawiki/core/+/e92731f51cc912edd36f12adb86913d534ddb19a/resources/src/mediawiki.page.preview.js#331

editlink

Edit MediaWiki:Editlink to <script>alert("MW core XSS")</script>
Edit any page
Paste any template invocation into the edit box, e.g. {{SomeTemplate}}. The template does not have to exist on your wiki.
Click "Show preview"

Cause: https://gerrit.wikimedia.org/g/mediawiki/core/+/e92731f51cc912edd36f12adb86913d534ddb19a/resources/src/mediawiki.page.preview.js#215

viewsourcelink

Not sure how to reproduce this, but you need to get a template to be not editable (this needs to be false: https://gerrit.wikimedia.org/g/mediawiki/core/+/e92731f51cc912edd36f12adb86913d534ddb19a/resources/src/mediawiki.page.preview.js#196). Then the steps should be almost the same as the ones for editlink.

Cause: https://gerrit.wikimedia.org/g/mediawiki/core/+/e92731f51cc912edd36f12adb86913d534ddb19a/resources/src/mediawiki.page.preview.js#215

Additional information

MW: 1.45.0-alpha (a98c588)
PHP: 8.3.14 (fpm-fcgi)

Details

Risk Rating: Low
Author Affiliation: Wikimedia Communities

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
SECURITY: Escape three system messages used by live preview	Reedy	mediawiki/core	master	+2 -2
SECURITY: Escape three system messages used by live preview	Reedy	mediawiki/core	REL1_44	+2 -2
SECURITY: Escape three system messages used by live preview	Reedy	mediawiki/core	REL1_43	+2 -2

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
			Restricted Task
Resolved		None	T397767 Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1
			Restricted Task
Resolved	Security	SomeRandomDeveloper	T394856 CVE-2025-61637: Stored XSS through system messages in MW Core

Event Timeline

SomeRandomDeveloper created this task.May 20 2025, 9:26 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 20 2025, 9:26 PM

SomeRandomDeveloper added a parent task: Restricted Task.May 20 2025, 9:26 PM

Patch suggestion:

Core.diff1 KBDownload

I do not have selenium tests set up, so I am unable to fully test this locally.

SomeRandomDeveloper added a subtask: T394863: CVE-2025-6595: Stored XSS through system messages in MultimediaViewer.May 20 2025, 10:27 PM

SomeRandomDeveloper removed a subtask: T394863: CVE-2025-6595: Stored XSS through system messages in MultimediaViewer.

Aklapper added a project: MediaWiki-General.May 21 2025, 6:40 AM

Thanks @SomeRandomDeveloper for the suggested patch.

Per https://wikitech.wikimedia.org/wiki/How_to_deploy_code#Creating_a_Security_Patch, the patches that are deployed need to be created with a commit message. If you could re-create your patch using the steps specified at that link that would be helpful. Thanks.

The way you created the patch in T394869#10844606 should be good for the above. Thanks.

T394856.patch1 KBDownload

In T394856#10844705, @SomeRandomDeveloper wrote:

T394856.patch1 KBDownload

CR+1

In T394856#10844718, @sbassett wrote:

In T394856#10844705, @SomeRandomDeveloper wrote:

T394856.patch1 KBDownload

CR+1

Deployed

sbassett changed the task status from Open to In Progress.Jun 10 2025, 7:01 PM

sbassett triaged this task as Low priority.

@sbassett any reason why this was not part of MW 1.43.2? Anybody trying to reproduce T394938: CVE-2025-53494: Stored XSS through a system message in TwoColConflict (which was fixed publicly on gerrit) could easily stumble upon the preview i18n XSS in core as well.

sbassett added a parent task: T397767: Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1.Jul 1 2025, 4:13 PM

In T394856#10962250, @SomeRandomDeveloper wrote:

@sbassett any reason why this was not part of MW 1.43.2? Anybody trying to reproduce T394938: CVE-2025-53494: Stored XSS through a system message in TwoColConflict (which was fixed publicly on gerrit) could easily stumble upon the preview i18n XSS in core as well.

Not really sure. I've added it to the tracking task for the next core release. In general, the Security-Team views Message API XSSes as fairly low-risk (we've pushed many of them publicly through gerrit) since one would still need to compromise ifadmin permissions or force something nefarious through translatewiki or gerrit to override system messages like this.

sbassett assigned this task to SomeRandomDeveloper.Jul 8 2025, 8:41 PM

Reedy added a subscriber: gerritbot.Sep 17 2025, 1:37 PM

Reedy renamed this task from Stored XSS through system messages in MW Core to CVE-2025-61637: Stored XSS through system messages in MW Core.Sep 29 2025, 1:21 PM

Reedy added projects: MW-1.43-release, MW-1.44-release.Sep 29 2025, 6:34 PM

Reedy closed this task as Resolved.Oct 1 2025, 8:50 PM

Change #1193171 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@REL1_43] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193171

gerritbot added a project: Patch-For-Review.Oct 2 2025, 6:49 PM

Change #1193171 merged by jenkins-bot:

[mediawiki/core@REL1_43] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193171

Change #1193195 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@REL1_44] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193195

Change #1193195 merged by jenkins-bot:

[mediawiki/core@REL1_44] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193195

Change #1193217 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@master] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193217

Change #1193217 merged by jenkins-bot:

[mediawiki/core@master] SECURITY: Escape three system messages used by live preview

https://gerrit.wikimedia.org/r/1193217

sbassett changed Author Affiliation from N/A to Wikimedia Communities.Apr 6 2026, 9:16 PM

sbassett removed a project: Patch-For-Review.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Low.

sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.

A_smart_kitten subscribed.Apr 7 2026, 5:58 AM

CVE-2025-61637: Stored XSS through system messages in MW CoreClosed, ResolvedPublicSecurityActions