Maniphest T402075

CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core)
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	SomeRandomDeveloper
	Aug 16 2025, 8:35 AM

Project Tags

Referenced Files

	F65758894: T402075.patch
	Aug 16 2025, 8:44 AM

	F65758871: image.png
	Aug 16 2025, 8:35 AM

	F65758874: image.png
	Aug 16 2025, 8:35 AM

Subscribers

View All 9 Subscribers

Description

The rcfilters-filter-showlinkedfrom-option-label and rcfilters-filter-showlinkedto-option-label system messages are inserted as raw HTML in Special:RecentChangesLinked, allowing for stored XSS.

Reproduction steps

Make sure $wgUseXssLanguage is set to true
Go to /wiki/Special:RecentChangesLinked?uselang=x-xss

Cause

The messages are retrieved using mw.msg, which returns the contents unescaped. These values are passed to OOUI labels via HtmlSnippets, causing them to be inserted as raw HTML.
https://gerrit.wikimedia.org/g/mediawiki/core/+/4ad1e30eabe2a079b3d350264c610f7b87f88a6d/resources/src/mediawiki.rcfilters/ui/RclToOrFromWidget.js#20
https://gerrit.wikimedia.org/g/mediawiki/core/+/4ad1e30eabe2a079b3d350264c610f7b87f88a6d/resources/src/mediawiki.rcfilters/ui/RclToOrFromWidget.js#24

Additional information

MediaWiki: 1.45.0-alpha (4ad1e30)
Vector: a13cbaa

Details

Risk Rating: Low
Author Affiliation: Wikimedia Communities

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
SECURITY: Parse messages instead of inserting them as HTML	Reedy	mediawiki/core	master	+2 -2
SECURITY: Parse messages instead of inserting them as HTML	Reedy	mediawiki/core	REL1_44	+2 -2
SECURITY: Parse messages instead of inserting them as HTML	Reedy	mediawiki/core	REL1_43	+2 -2
SECURITY: Parse messages instead of inserting them as HTML	Reedy	mediawiki/core	REL1_39	+2 -2

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
			Restricted Task
Resolved		None	T397767 Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1
Resolved	Security	• Jly	T402075 CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core)

Event Timeline

SomeRandomDeveloper created this task.Aug 16 2025, 8:35 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 16 2025, 8:35 AM

SomeRandomDeveloper claimed this task.Aug 16 2025, 8:35 AM

SomeRandomDeveloper added projects: Vuln-XSS, affects-Miraheze, MediaWiki-Recent-changes.

Restricted Application added a project: Moderator-Tools-Team. · View Herald TranscriptAug 16 2025, 8:35 AM

Patch:

T402075.patch1 KBDownload

SomeRandomDeveloper updated the task description. (Show Details)Aug 16 2025, 8:45 AM

SomeRandomDeveloper added a project: Patch-For-Review.Aug 16 2025, 9:26 AM

sbassett changed the task status from Open to In Progress.Aug 18 2025, 4:35 PM

sbassett reassigned this task from SomeRandomDeveloper to • Jly.

sbassett triaged this task as Low priority.

sbassett moved this task from Incoming to In Progress on the Security-Team board.

sbassett added a project: SecTeam-Processed.

Thanks, this looks good and tested. We will get it deployed today.

sbassett moved this task from In Progress to Security Patch To Deploy on the Security-Team board.Aug 18 2025, 8:37 PM

In T402075#11091385, @SomeRandomDeveloper wrote:

Patch:

T402075.patch1 KBDownload

Deployed

Mstyles added a parent task: T397767: Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1.Aug 19 2025, 12:23 AM

Mstyles moved this task from Security Patch To Deploy to In Progress on the Security-Team board.

Samwalton9-WMF added a subscriber: jsn.sherman.Aug 19 2025, 11:37 AM

sbassett moved this task from In Progress to Watching on the Security-Team board.Aug 25 2025, 4:16 PM

jsn.sherman moved this task from Inbox to To be estimated on the Moderator-Tools-Team board.Aug 27 2025, 6:43 PM

jsn.sherman added subscribers: Dillon, • Kgraessle.

jsn.sherman added a subscriber: • Scardenasmolinar.

SomeRandomDeveloper merged a task: Restricted Task.Sep 1 2025, 4:22 PM

SomeRandomDeveloper added a subscriber: Dreamy_Jazz.

Reedy added a subscriber: gerritbot.Sep 17 2025, 1:37 PM

Reedy renamed this task from Stored XSS through system messages in Special:RecentChangesLinked (MW Core) to CVE-2025-61641: Stored XSS through system messages in Special:RecentChangesLinked (MW Core).Sep 29 2025, 1:23 PM

Reedy renamed this task from CVE-2025-61641: Stored XSS through system messages in Special:RecentChangesLinked (MW Core) to CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core).

Reedy added projects: MW-1.43-release, MW-1.44-release, MW-1.39-release.Sep 29 2025, 6:49 PM

Reedy closed this task as Resolved.Oct 1 2025, 8:55 PM

Change #1193149 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@REL1_39] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193149

Change #1193149 merged by jenkins-bot:

[mediawiki/core@REL1_39] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193149

Change #1193173 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@REL1_43] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193173

Change #1193173 merged by jenkins-bot:

[mediawiki/core@REL1_43] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193173

Change #1193198 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@REL1_44] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193198

Change #1193198 merged by jenkins-bot:

[mediawiki/core@REL1_44] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193198

Change #1193220 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/core@master] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193220

Change #1193220 merged by jenkins-bot:

[mediawiki/core@master] SECURITY: Parse messages instead of inserting them as HTML

https://gerrit.wikimedia.org/r/1193220

Could this be made public?

sbassett removed a project: Patch-For-Review.Apr 6 2026, 2:08 PM

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Low.

sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.

CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core)Closed, ResolvedPublicSecurityActions