Page MenuHomePhabricator
Create Task
Maniphest T404620

Write and send supplementary release announcement for extensions and skins with security patches (1.39.16/1.43.6/1.44.3/1.45.1)
Closed, ResolvedPublic
Actions

Description

Previous work: T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1)

Issue IDExtension or SkinCVE IDREL1_39REL1_43REL1_44REL1_45master/main
GHSA-g955-vw6w-v6ppCitizenCVE-2025-62508N/AN/AN/AN/AYes
T387008VisualDataCVE-2026-0668N/AN/AN/ANoYes, Yes, Yes, Yes
T401526CSSCVE-2026-0669YesYesYesN/AYes
T407157UploadWizardCVE-2026-0671NoYesYesYesYes
T409423ProofreadPageCVE-2026-0670NoYesYesYesYes
T409737WikibaseCVE-2026-22710NoYesNoYesYes
T411126MonacoCVE-2026-22714N/AN/AN/AYesYes
T411144GrowthExperimentsCVE-2026-22713NoNoNoNoYes
T412068ApprovedRevsCVE-2026-22712N/AN/AYesYesYes
T410560CampaignEventsCVE-2026-0817NoNoNoNoYes

Details

Other Assignee
Mstyles

Related Objects
Search...

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Sep 15 2025, 4:25 PM
Reedy subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 15 2025, 4:25 PM
Reedy added a parent task: T404610: Release MediaWiki 1.39.16/1.43.6/1.44.3/1.45.1.Sep 15 2025, 4:25 PM
Reedy added subscribers: mmartorana, Mstyles, sbassett.
Reedy updated the task description. (Show Details)Sep 15 2025, 4:27 PM
Reedy renamed this task from Write and send supplementary release announcement for extensions and skins with security patches (1.39.15/1.43.5/1.44.2/1.45.0) to Write and send supplementary release announcement for extensions and skins with security patches (1.39.16/1.43.6/1.44.3/1.45.0).Oct 3 2025, 1:19 PM
sbassett added a project: user-sbassett.Oct 8 2025, 12:07 AM
sbassett moved this task from Backlog to In Progress on the user-sbassett board.
sbassett mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Oct 14 2025, 5:44 PM
sbassett updated the task description. (Show Details)
sbassett added subscribers: Bawolff, SomeRandomDeveloper, A_smart_kitten, RhinosF1.
SomeRandomDeveloper updated the task description. (Show Details)Oct 16 2025, 8:54 PM
SomeRandomDeveloper updated the task description. (Show Details)Oct 16 2025, 8:57 PM

(added REL1_45 since I assume that will be necessary in two weeks)

SomeRandomDeveloper updated the task description. (Show Details)Oct 17 2025, 5:06 PM
SomeRandomDeveloper updated the task description. (Show Details)Oct 17 2025, 7:27 PM
sbassett updated the task description. (Show Details)Oct 20 2025, 7:56 PM
sbassett mentioned this in T387008: CVE-2026-0668: VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input.
sbassett changed the task status from Open to In Progress.Oct 27 2025, 7:28 PM
sbassett triaged this task as Low priority.
sbassett updated the task description. (Show Details)
sbassett updated the task description. (Show Details)
sbassett updated the task description. (Show Details)Oct 27 2025, 7:30 PM
SomeRandomDeveloper updated the task description. (Show Details)Oct 31 2025, 1:42 PM
sbassett mentioned this in T401526: CVE-2026-0669: Path Traversal vulnerability in CSS extension on certain web servers.Nov 3 2025, 4:19 PM
SomeRandomDeveloper updated the task description. (Show Details)Nov 6 2025, 11:52 AM
SomeRandomDeveloper updated the task description. (Show Details)Nov 11 2025, 6:53 PM
sbassett updated the task description. (Show Details)Nov 24 2025, 10:49 PM
SomeRandomDeveloper updated the task description. (Show Details)Nov 26 2025, 8:09 PM
SomeRandomDeveloper updated the task description. (Show Details)Nov 28 2025, 2:19 PM
Mstyles updated the task description. (Show Details)Dec 1 2025, 10:49 PM
Reedy renamed this task from Write and send supplementary release announcement for extensions and skins with security patches (1.39.16/1.43.6/1.44.3/1.45.0) to Write and send supplementary release announcement for extensions and skins with security patches (1.39.16/1.43.6/1.44.3/1.45.1).Dec 8 2025, 8:43 PM
SomeRandomDeveloper updated the task description. (Show Details)Dec 17 2025, 9:58 PM
SomeRandomDeveloper updated the task description. (Show Details)Dec 17 2025, 10:08 PM
sbassett mentioned this in T412068: CVE-2026-22712: ApprovedRevs allows bypassing the inline CSS sanitizer due to magic word replacement in ParserAfterTidy.Dec 18 2025, 5:16 PM
SomeRandomDeveloper updated the task description. (Show Details)Dec 21 2025, 1:46 AM
sbassett assigned this task to mmartorana.Jan 5 2026, 6:18 PM
sbassett raised the priority of this task from Low to High.
sbassett updated Other Assignee, added: Mstyles.
Mstyles added a comment.Jan 6 2026, 1:31 AM

CVE/Backport Assignments

Start VulnEnd VulnAssignee
T387008 VisualDataT409423 ProofreadPage@mmartorana
T409737 WikibaseT412068 ApprovedRevs@Mstyles

Note: post your email-formatted updates as comments below (see previous email: T397776#11291485)

mmartorana updated the task description. (Show Details)Jan 7 2026, 5:17 PM
mmartorana updated the task description. (Show Details)Jan 7 2026, 5:37 PM
mmartorana updated the task description. (Show Details)Jan 7 2026, 5:47 PM
mmartorana updated the task description. (Show Details)Jan 7 2026, 6:56 PM
mmartorana updated the task description. (Show Details)Jan 8 2026, 3:38 PM
mmartorana updated the task description. (Show Details)Jan 8 2026, 3:44 PM
mmartorana updated the task description. (Show Details)Jan 8 2026, 4:22 PM
mmartorana added a comment.EditedJan 8 2026, 4:34 PM
Draft Email For Release - Please comment with any questions/concerns - otherwise this will be sent to the relevant mailing lists on 01/09/2026
Subject: MediaWiki Extensions and Skins Security Release Supplement (1.39.16/1.43.6/1.44.3/1.45.1)

Greetings-

With the security/maintenance release of MediaWiki 1.39.16/1.43.6/1.44.3/1.45.1, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]:

Citizen
+ (GHSA-g955-vw6w-v6pp, CVE-2025-62508) - Stored XSS in sticky header button messages
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp

VisualData
+ (T387008, CVE-2026-0668) - VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input
https://gerrit.wikimedia.org/r/q/Ie08d9a8ceb2c9a22a635cfc27964353f14072dbf 
https://gerrit.wikimedia.org/r/q/Ifbf9c2ade621226e14fe852f3217293772bf8bb8 
https://gerrit.wikimedia.org/r/q/I893a9fca694a2613e29e149dea2d76d7f06063e5 
https://gerrit.wikimedia.org/r/q/I4ff2737c9f0ba805267d1fc8296e7cff61241ee3 

CSS
+ (T401526, CVE-2026-0669) - Path Traversal vulnerability in CSS extension on certain web servers
https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e 

UploadWizard
+ (T407157, CVE-2026-0671) - Multiple stored i18n/message-key XSSes in UploadWizard
https://gerrit.wikimedia.org/r/q/I16de2211594ea9a686868ad7789f9879bf981fa1

ProofreadPage
+ (T409423, CVE-2026-0670) - Stored XSS through a system message and a user-provided parameter in ProofreadPage
https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c

Wikibase
+ (T409737, CVE-2026-22710) - Stored XSS through autocomment system messages
https://gerrit.wikimedia.org/r/q/I8505700afda8096ef4e183280494232152767004

Monaco
+ (T411126, CVE-2026-22714) - i18n XSS, DoS and config SQLI
https://gerrit.wikimedia.org/r/q/I00b2e369fa189803380ca7409022a11b670d2500

GrowthExperiments
+ (T411144, CVE-2026-22713) - Stored XSS through edit summaries
https://gerrit.wikimedia.org/r/q/Iff01940a163ed87ec52f3a64ba6b2dbfa2759df3

ApprovedRevs
+ (T412068, CVE-2026-22712) - Bypassing the inline CSS sanitizer
https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a

CampaignEvents
+ (T410560, CVE-2026-0817) - CampaignEvents API missing authorization exposes meeting and chat URLs
https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358

The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security@wikimedia.org or file a security task within Phabricator [3].

[1] https://phabricator.wikimedia.org/T404620
[2] https://www.mediawiki.org/wiki/Version_lifecycle
[3] https://www.mediawiki.org/wiki/Reporting_security_bugs
Mstyles updated the task description. (Show Details)Jan 8 2026, 6:00 PM
mmartorana updated the task description. (Show Details)Jan 8 2026, 6:32 PM
mmartorana updated the task description. (Show Details)Jan 8 2026, 6:55 PM
Mstyles updated the task description. (Show Details)Jan 9 2026, 12:08 AM
Mstyles added a comment.Jan 9 2026, 4:18 AM

Wikibase Extension
+ (T409737, CVE-2026-22710) - Stored XSS through autocomment system messages
https://gerrit.wikimedia.org/r/q/I8505700afda8096ef4e183280494232152767004

Monaco Skin
+ (T411126, CVE-2026-22714) -i18n XSS, DoS and config SQLI
https://gerrit.wikimedia.org/r/q/I00b2e369fa189803380ca7409022a11b670d2500

GrowthExperiments Extension
+ (T411144, CVE-2026-22713) - Stored XSS through edit summaries
https://gerrit.wikimedia.org/r/q/Iff01940a163ed87ec52f3a64ba6b2dbfa2759df3

ApprovedRevs Extension
+ (T412068, CVE-2026-22712) - Bypassing the inline CSS sanitizer
https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a

SomeRandomDeveloper mentioned this in T409423: CVE-2026-0670: Stored XSS through a system message and a user-provided parameter in ProofreadPage.Jan 9 2026, 1:10 PM
mmartorana updated the task description. (Show Details)Jan 9 2026, 2:46 PM
mmartorana updated the task description. (Show Details)Jan 9 2026, 3:38 PM
mmartorana updated the task description. (Show Details)
mmartorana updated the task description. (Show Details)Jan 9 2026, 3:52 PM
Mstyles added a subscriber: gerritbot.Jan 9 2026, 4:58 PM
mmartorana changed the visibility from "Custom Policy" to "Public (No Login Required)".Jan 9 2026, 5:40 PM
mmartorana changed the edit policy from "Subscribers" to "All Users".
mmartorana closed this task as Resolved.Jan 9 2026, 6:03 PM

Email from T404620#11504513 has been sent to various mailing lists:

sbassett updated the task description. (Show Details)Jan 9 2026, 10:37 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits