Page MenuHomePhabricator
Create Task
Maniphest T416502

CVE-2026-22711: Stored XSS through system messages in WikiLove
Closed, ResolvedPublicSecurity
Actions

Description

Multiple system messages in WikiLove can be abused by users with the editinterface permission to execute arbitrary JS.

wikilove-commons-text/wikilove-commons-url

  1. Edit MediaWiki:Wikilove-commons-text to <div class="$1">Hover over me!</div>
  2. Edit MediaWiki:Wikilove-commons-url to /onmouseenter=alert(1)//
  3. Make sure you have WikiLove enabled in your preferences
  4. Go to a user page
  5. Click on the heart icon next to the "View history" link
  6. Click on "Make your own"
  7. Hover over the text that says "Hover over me!"

Pasted image 20260129194109.png (929×672 px, 88 KB)

wikilove-terms/wikilove-terms-url

The same steps as above can be done with wikilove-terms and wikilove-terms-url. The element is shown after previewing an award.

It's also possible to use a javascript: link in either wikilove-commons-url or wikilove-terms-url.

Cause

https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLove/+/93b9281a3f7f4d270cf510a3f28a48a6a6404d63/resources/ext.wikiLove.startup/WikiLoveDialog.vue#154
It's not safe to perform string replacements on HTML, especially when inserting another HTML element.

https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/WikiLove/+/93b9281a3f7f4d270cf510a3f28a48a6a6404d63/resources/ext.wikiLove.startup/wikiLove.js#69
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/WikiLove/+/93b9281a3f7f4d270cf510a3f28a48a6a6404d63/resources/ext.wikiLove.startup/wikiLove.js#73
The URL protocol is not validated.

Additional information

MW: 1.46.0-alpha (2633444)
WikiLove: 1.3.1 (93b9281)

Details

Risk Rating
Medium
Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Sanitize URLs and use jQuery to build linksSomeRandomDevelopermediawiki/extensions/WikiLoveREL1_43+19 -30
SECURITY: Sanitize URLs and use jQuery to build linksSomeRandomDevelopermediawiki/extensions/WikiLoveREL1_45+19 -30
SECURITY: Sanitize URLs and use jQuery to build linksSomeRandomDevelopermediawiki/extensions/WikiLoveREL1_44+19 -30
SECURITY: Sanitize URLs and use jQuery to build linksSomeRandomDevelopermediawiki/extensions/WikiLovemaster+19 -30
Customize query in gerrit

Related Objects

Event Timeline

SomeRandomDeveloper created this task.Feb 4 2026, 5:45 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 4 2026, 5:45 PM
SomeRandomDeveloper claimed this task.Feb 4 2026, 5:46 PM
SomeRandomDeveloper added projects: WikiLove, Vuln-XSS, affects-Miraheze.
SomeRandomDeveloper added a project: Patch-For-Review.Feb 4 2026, 5:51 PM

T416502.patch4 KBDownload

SomeRandomDeveloper mentioned this in T411394: Write and send supplementary release announcement for extensions and skins with security patches (1.43.7/1.44.4/1.45.2).Feb 4 2026, 5:52 PM
sbassett moved this task from Incoming to Security Patch To Deploy on the Security-Team board.Feb 4 2026, 9:18 PM
sbassett added a project: SecTeam-Processed.
sbassett subscribed.
In T416502#11584441, @SomeRandomDeveloper wrote:

T416502.patch4 KBDownload

Patch looks fine to me. I think we can get this deployed to Wikimedia production during the ad-hoc security deployment window we have scheduled tomorrow (2026-02-04), after the late backport window.

sbassett changed the task status from Open to In Progress.Feb 4 2026, 9:18 PM
sbassett triaged this task as Medium priority.
Mstyles added a subscriber: Scott_French.Feb 5 2026, 10:43 PM
Mstyles subscribed.Feb 5 2026, 11:30 PM
In T416502#11585143, @sbassett wrote:
In T416502#11584441, @SomeRandomDeveloper wrote:

T416502.patch4 KBDownload

Patch looks fine to me. I think we can get this deployed to Wikimedia production during the ad-hoc security deployment window we have scheduled tomorrow (2026-02-04), after the late backport window.

Deployed

Mstyles moved this task from Security Patch To Deploy to Watching on the Security-Team board.Feb 5 2026, 11:35 PM
SomeRandomDeveloper removed a project: Patch-For-Review.Mar 6 2026, 9:24 PM
SomeRandomDeveloper added a subscriber: gerritbot.Mar 14 2026, 2:28 PM
gerritbot added a comment.Mar 14 2026, 2:29 PM

Change #1251947 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WikiLove@master] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251947

gerritbot added a project: Patch-For-Review.Mar 14 2026, 2:29 PM
gerritbot added a comment.Mar 14 2026, 2:32 PM

Change #1251949 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WikiLove@REL1_45] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251949

gerritbot added a comment.Mar 14 2026, 2:33 PM

Change #1251950 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WikiLove@REL1_44] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251950

gerritbot added a comment.Mar 14 2026, 2:45 PM

Change #1251952 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/WikiLove@REL1_43] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251952

gerritbot added a comment.Mar 14 2026, 2:45 PM

Change #1251947 merged by jenkins-bot:

[mediawiki/extensions/WikiLove@master] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251947

gerritbot added a comment.Mar 14 2026, 2:53 PM

Change #1251950 merged by jenkins-bot:

[mediawiki/extensions/WikiLove@REL1_44] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251950

gerritbot added a comment.Mar 14 2026, 2:54 PM

Change #1251949 merged by jenkins-bot:

[mediawiki/extensions/WikiLove@REL1_45] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251949

gerritbot added a comment.Mar 14 2026, 3:00 PM

Change #1251952 merged by jenkins-bot:

[mediawiki/extensions/WikiLove@REL1_43] SECURITY: Sanitize URLs and use jQuery to build links

https://gerrit.wikimedia.org/r/1251952

SomeRandomDeveloper closed this task as Resolved.Mar 14 2026, 3:32 PM
SomeRandomDeveloper removed a project: Patch-For-Review.
Mstyles renamed this task from Stored XSS through system messages in WikiLove to CVE-2026-22711: Stored XSS through system messages in WikiLove.Apr 7 2026, 6:40 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".Apr 8 2026, 3:05 PM
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Medium.
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits