CVE-2025-62694: Stored XSS through a system message in WikiLove
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	SomeRandomDeveloper
	Jul 26 2025, 12:17 AM

Description

The WikiLove extension is vulnerable to stored XSS through the wikilove-what-is-this-link system message.

Reproduction

Edit MediaWiki:Wikilove-what-is-this-link to javascript:alert(document.domain)
Go to Special:Preferences and enable Enable showing appreciation for other users with the WikiLove tab under the Editing tab
Go to the talk page of a different user and click on the heart icon
Middle click on the "What is this?" link
If the new tab has opened in the background, open it

Cause

The message is inserted into the href attribute of an HTML element without any validation:
https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLove/+/5835f41c7995b45feed96850d64e3ecc9596adb3/resources/ext.wikiLove.startup/WikiLoveDialog.vue#27

Additional information

MediaWiki: 1.45.0-alpha (81259da)
WikiLove: 5835f41

Details

Author Affiliation: Wikimedia Communities

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	SECURITY: Sanitize URL to prevent stored i18n XSS	mediawiki/extensions/WikiLove	REL1_39	+14 -1

Customize query in gerrit

Related Objects

Mentioned In: T407157: CVE-2026-0671: Multiple stored i18n/message-key XSSes in UploadWizard
T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1)
Mentioned Here: rMW81259da8170e: language: Move hook interfaces to MediaWiki\Language\Hook\ namespace
rEWLO5835f41c7995: Localisation updates from https://translatewiki.net.

Event Timeline

SomeRandomDeveloper created this task.Jul 26 2025, 12:17 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 26 2025, 12:17 AM

SomeRandomDeveloper added projects: Vuln-XSS, WikiLove, affects-Miraheze.Jul 26 2025, 12:17 AM

Restricted Application added a project: Growth-Team. · View Herald TranscriptJul 26 2025, 12:17 AM

SomeRandomDeveloper mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Jul 26 2025, 12:19 AM

I don't think it's contextually perfect here, but a quick fix should just involve adding an .escaped(), no?

<a target="_blank" :href="$i18n( 'wikilove-what-is-this-link' ).escaped()">
    {{ $i18n( 'wikilove-what-is-this' ) }}
</a>

In T400525#11040333, @sbassett wrote:
I don't think it's contextually perfect here, but a quick fix should just involve adding an .escaped(), no?
<a target="_blank" :href="$i18n( 'wikilove-what-is-this-link' ).escaped()">
    {{ $i18n( 'wikilove-what-is-this' ) }}
</a>

Escaping javascript:alert(document.domain) does not change anything since there are no characters that would be escaped in the payload. Since this is a URL, this will probably need custom logic similar to Skin::makeInternalOrExternalUrl (source) in PHP.

Sgs moved this task from Inbox to Backlog on the Growth-Team board.Jul 29 2025, 2:14 PM

In T400525#11041304, @SomeRandomDeveloper wrote:

Escaping javascript:alert(document.domain) does not change anything since there are no characters that would be escaped in the payload. Since this is a URL, this will probably need custom logic similar to Skin::makeInternalOrExternalUrl (source) in PHP.

Yeah, I'd hate to reinvent the wheel and try to port that over to JS. We've used DOMPurify in VE and other places in the past for this kind of thing. Their basic sanitize() function is very context-aware IME and is effective in sanitizing various malicious href attribute patterns (online demo). The downside is that it's a somewhat-bloated upstream dependency that would need to be bundled with the extension.

Urbanecm_WMF added subscribers: KStoller-WMF, Michael, Sgs and 3 others.Jul 30 2025, 4:50 PM

Aklapper removed a project: Growth-Team.Aug 1 2025, 11:03 AM

sbassett added a subscriber: Jdlrobson-WMF.Aug 1 2025, 2:36 PM

sbassett changed the task status from Open to In Progress.Aug 11 2025, 4:48 PM

sbassett assigned this task to Catrope.

sbassett triaged this task as Medium priority.

sbassett moved this task from Incoming to In Progress on the Security-Team board.

sbassett added a project: SecTeam-Processed.

@Catrope let me know if you need a hand with this one. I have familiarity with the code here.

Proposed patch:

0001-SECURITY-Sanitize-link-URL-from-i18n-message-before-.patch3 KBDownload

In T400525#11094851, @Catrope wrote:

Proposed patch:

0001-SECURITY-Sanitize-link-URL-from-i18n-message-before-.patch3 KBDownload

+1, I've tested this locally and can't reproduce the vulnerability anymore (and the normal link still works fine for me).

sbassett moved this task from In Progress to Security Patch To Deploy on the Security-Team board.Aug 25 2025, 4:14 PM

The above patch was deployed during today's (2025-08-25) security window.

Reedy removed a project: Patch-For-Review.Sep 17 2025, 10:51 AM

Reedy closed this task as Resolved.Sep 17 2025, 1:42 PM

Reedy added a subscriber: gerritbot.

(This was merged on master and backported to REL1_43 and REL1_44, but the task wasn't mentioned in the commit message, so there are no gerritbot notifications here)

This needs to be backported to REL1_39 too (it's in a different file in that version):
https://github.com/wikimedia/mediawiki-extensions-WikiLove/blob/7e34f9b1fe947f1136450657b0ea2482bc7ef9c4/resources/ext.wikiLove.core.js#L91

Since callbacks seem to not be supported by ResourceLoader in 1.39 (correct me if I'm wrong), I've made a separate patch that is mostly a band-aid fix and only supports HTTPS and HTTP. However, given that 1.39 will be EOL in December and I assume almost nobody has a reason to edit this message and insert a non-HTTP link, it should be fine to fix it this way:

T400525.patch2 KBDownload

In T400525#11192254, @SomeRandomDeveloper wrote:

Since callbacks seem to not be supported by ResourceLoader in 1.39 (correct me if I'm wrong), I've made a separate patch that is mostly a band-aid fix and only supports HTTPS and HTTP. However, given that 1.39 will be EOL in December and I assume almost nobody has a reason to edit this message and insert a non-HTTP link, it should be fine to fix it this way:

T400525.patch2 KBDownload

@sbassett could we have somebody review this backport patch and then push it through gerrit?

In T400525#11212330, @SomeRandomDeveloper wrote:

In T400525#11192254, @SomeRandomDeveloper wrote:

Since callbacks seem to not be supported by ResourceLoader in 1.39 (correct me if I'm wrong), I've made a separate patch that is mostly a band-aid fix and only supports HTTPS and HTTP. However, given that 1.39 will be EOL in December and I assume almost nobody has a reason to edit this message and insert a non-HTTP link, it should be fine to fix it this way:

T400525.patch2 KBDownload

@sbassett could we have somebody review this backport patch and then push it through gerrit?

CR+1, I can push it up to gerrit for REL1_39 in a minute.

Change #1191439 had a related patch set uploaded (by SBassett; author: SomeRandomDeveloper):

[mediawiki/extensions/WikiLove@REL1_39] SECURITY: Sanitize URL to prevent stored i18n XSS

https://gerrit.wikimedia.org/r/1191439

gerritbot added a project: Patch-For-Review.Sep 25 2025, 3:27 PM

Change #1191439 merged by jenkins-bot:

[mediawiki/extensions/WikiLove@REL1_39] SECURITY: Sanitize URL to prevent stored i18n XSS

https://gerrit.wikimedia.org/r/1191439

In T400525#11215014, @sbassett wrote:

In T400525#11212330, @SomeRandomDeveloper wrote:

In T400525#11192254, @SomeRandomDeveloper wrote:

Since callbacks seem to not be supported by ResourceLoader in 1.39 (correct me if I'm wrong), I've made a separate patch that is mostly a band-aid fix and only supports HTTPS and HTTP. However, given that 1.39 will be EOL in December and I assume almost nobody has a reason to edit this message and insert a non-HTTP link, it should be fine to fix it this way:

T400525.patch2 KBDownload

@sbassett could we have somebody review this backport patch and then push it through gerrit?

CR+1, I can push it up to gerrit for REL1_39 in a minute.

Thanks!

Mstyles renamed this task from Stored XSS through a system message in WikiLove to CVE-2025-62694: Stored XSS through a system message in WikiLove.Oct 21 2025, 5:46 AM

Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".

Mstyles changed the edit policy from "Custom Policy" to "All Users".

SomeRandomDeveloper mentioned this in T407157: CVE-2026-0671: Multiple stored i18n/message-key XSSes in UploadWizard.Nov 5 2025, 10:42 PM

	F65779127: 0001-SECURITY-Sanitize-link-URL-from-i18n-message-before-.patch
	Aug 18 2025, 4:07 PM

	F66029028: T400525.patch
	Sep 17 2025, 11:54 PM

CVE-2025-62694: Stored XSS through a system message in WikiLoveClosed, ResolvedPublicSecurityActions