Page MenuHomePhabricator
Create Task
Maniphest T416050

CVE-2026-25129: PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
Closed, ResolvedPublic
Actions

Description

https://github.com/advisories/GHSA-4486-gxhx-5mg7

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Release v4.5.0Jforrestermediawiki/libs/Shellboxmaster+40 -0
Upgrading psy/psysh (v0.12.10 => v0.12.19)Reedymediawiki/vendorwmf/1.46.0-wmf.13+9 K -727
Update psy/psysh to ^0.12.19Reedymediawiki/coremaster+2 -1
Update psy/psysh to ^0.12.19Reedymediawiki/coreREL1_44+1 -1
Update psy/psysh to ^0.12.19Reedymediawiki/coreREL1_43+1 -1
Update psy/psysh to ^0.12.19Reedymediawiki/coreREL1_45+1 -1
Upgrading psy/psysh (v0.12.10 => v0.12.19)Zabemediawiki/vendorwmf/1.46.0-wmf.13+9 K -727
Upgrading psy/psysh (v0.12.10 => v0.12.19)Reedymediawiki/vendormaster+9 K -727
Upgrading psy/psysh (v0.10.12 => v0.12.19)Reedymediawiki/libs/Shellboxmaster+145 -203
Customize query in gerrit

Related Objects

Event Timeline

Reedy created this task.Jan 30 2026, 9:53 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 30 2026, 9:53 PM
Reedy triaged this task as Unbreak Now! priority.Jan 30 2026, 9:55 PM
gerritbot added a comment.Jan 30 2026, 9:55 PM

Change #1235405 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235405

gerritbot added a project: Patch-For-Review.Jan 30 2026, 9:55 PM
gerritbot added a comment.Jan 30 2026, 9:57 PM

Change #1235407 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@master] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235407

Reedy added projects: MW-1.43-release, MW-1.44-release, MW-1.45-release.Jan 30 2026, 9:58 PM
A_smart_kitten added a project: Security.Jan 30 2026, 10:01 PM
Reedy added a project: ci-test-error (WMF-deployed Build Failure).Jan 30 2026, 10:04 PM
gerritbot added a comment.Jan 30 2026, 10:22 PM

Change #1235413 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/libs/Shellbox@master] Upgrading psy/psysh (v0.10.12 => v0.12.19)

https://gerrit.wikimedia.org/r/1235413

gerritbot added a comment.Jan 30 2026, 10:24 PM

Change #1235413 merged by jenkins-bot:

[mediawiki/libs/Shellbox@master] Upgrading psy/psysh (v0.10.12 => v0.12.19)

https://gerrit.wikimedia.org/r/1235413

gerritbot added a comment.Jan 30 2026, 10:28 PM

Change #1235418 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235418

Zabe subscribed.Jan 31 2026, 12:24 AM
gerritbot added a comment.Jan 31 2026, 12:47 AM

Change #1235405 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235405

gerritbot added a comment.Jan 31 2026, 12:51 AM

Change #1235434 had a related patch set uploaded (by Zabe; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235434

gerritbot added a comment.Jan 31 2026, 12:53 AM

Change #1235418 abandoned by Zabe:

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235418

gerritbot added a comment.Jan 31 2026, 12:54 AM

Change #1235418 restored by Zabe:

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235418

gerritbot added a comment.Jan 31 2026, 12:54 AM

Change #1235434 abandoned by Zabe:

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235434

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.14; 2026-02-03).Jan 31 2026, 1:00 AM
gerritbot added a comment.Jan 31 2026, 1:20 AM

Change #1235407 merged by jenkins-bot:

[mediawiki/core@master] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235407

gerritbot added a comment.Jan 31 2026, 1:21 AM

Change #1235437 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_45] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235437

gerritbot added a comment.Jan 31 2026, 1:21 AM

Change #1235438 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_44] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235438

gerritbot added a comment.Jan 31 2026, 1:22 AM

Change #1235439 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_43] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235439

gerritbot added a comment.Jan 31 2026, 1:39 AM

Change #1235437 merged by jenkins-bot:

[mediawiki/core@REL1_45] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235437

gerritbot added a comment.Jan 31 2026, 1:41 AM

Change #1235439 merged by jenkins-bot:

[mediawiki/core@REL1_43] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235439

gerritbot added a comment.Jan 31 2026, 1:42 AM

Change #1235438 merged by jenkins-bot:

[mediawiki/core@REL1_44] Update psy/psysh to ^0.12.19

https://gerrit.wikimedia.org/r/1235438

ReleaseTaggerBot added projects: MW-1.43-notes, MW-1.44-notes, MW-1.45-notes.Jan 31 2026, 2:00 AM
Reedy lowered the priority of this task from Unbreak Now! to High.Jan 31 2026, 5:51 PM
gerritbot added a comment.Feb 2 2026, 9:36 AM

Change #1235418 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrading psy/psysh (v0.12.10 => v0.12.19)

https://gerrit.wikimedia.org/r/1235418

Stashbot added a comment.Feb 2 2026, 9:38 AM

Mentioned in SAL (#wikimedia-operations) [2026-02-02T09:38:19Z] <ihurbain@deploy2002> Started scap sync-world: Backport for [[gerrit:1235418|Upgrading psy/psysh (v0.12.10 => v0.12.19) (T416050)]], [[gerrit:1235386|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415328)]], [[gerrit:1235384|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415888 T415328)]]

Stashbot mentioned this in T415888: PHP Warning: Undefined property: Wikimedia\Parsoid\NodeData\NodeData::$mw.Feb 2 2026, 9:38 AM
Stashbot mentioned this in T415328: CTT tasks week of 2026-01-23.

Mentioned in SAL (#wikimedia-operations) [2026-02-02T09:40:14Z] <ihurbain@deploy2002> reedy, cscott, ihurbain: Backport for [[gerrit:1235418|Upgrading psy/psysh (v0.12.10 => v0.12.19) (T416050)]], [[gerrit:1235386|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415328)]], [[gerrit:1235384|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415888 T415328)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Feb 2 2026, 9:44 AM

Mentioned in SAL (#wikimedia-operations) [2026-02-02T09:44:56Z] <ihurbain@deploy2002> Finished scap sync-world: Backport for [[gerrit:1235418|Upgrading psy/psysh (v0.12.10 => v0.12.19) (T416050)]], [[gerrit:1235386|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415328)]], [[gerrit:1235384|Bump wikimedia/parsoid to 0.23.0-a13.1 (T415888 T415328)]] (duration: 06m 36s)

ReleaseTaggerBot edited projects, added: MW-1.46-notes (1.46.0-wmf.13; 2026-01-27); removed: MW-1.46-notes (1.46.0-wmf.14; 2026-02-03).Feb 2 2026, 10:00 AM
Reedy closed this task as Resolved.Feb 2 2026, 4:23 PM
Reedy claimed this task.
Reedy removed a project: Patch-For-Review.
gerritbot added a comment.May 12 2026, 12:57 PM

Change #1286347 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/libs/Shellbox@master] Release v4.5.0

https://gerrit.wikimedia.org/r/1286347

gerritbot added a project: Patch-For-Review.May 12 2026, 12:57 PM

Change #1286347 merged by jenkins-bot:

[mediawiki/libs/Shellbox@master] Release v4.5.0

https://gerrit.wikimedia.org/r/1286347

A_smart_kitten removed a project: Patch-For-Review.May 12 2026, 3:33 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits