Consider adding gui-ying233 to Security Hall of Fame
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	sbassett
	Jun 22 2026, 5:16 PM

Project Tags

Referenced Files

None

Subscribers

Description

Via security-help:

I'm gui-ying233. I would like to request the following two records for inclusion in the https://security.wikimedia.org/hall-of-fame/.

2025-08-04, 鬼影233 (https://gui-ying233.github.io/Nest/), T401099 (https://phabricator.wikimedia.org/T401099), MediaWiki 1.39.14/1.43.4/1.44.1, Stored XSS in MediaWiki Parser (Sanitizer), CVE-2025-61638.
2026-03-06, 鬼影233 (https://gui-ying233.github.io/Nest/), GHSA-4h5r-8rjm-496r (https://github.com/lihaohong6/RenderBlocking/security/advisories/GHSA-4h5r-8rjm-496r), RenderBlocking Extension, Stored XSS in renderblocking-css with Inline Assets mode, CVE-2026-30977.

If the Chinese reporter name is not acceptable, use gui-ying233;
If the GitHub Pages link is not acceptable, use https://github.com/gui-ying233.

Note: created this as a security task for intake purposes and in case of rejection.

Details

Risk Rating: Low
Author Affiliation: WMF Technology

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	chore: Deploy new version of security hall-of-fame	Rscout	operations/deployment-charts	master	+1 -1

Customize query in gerrit

Related Changes in GitLab:

	Title	Reference	Author	Source Branch	Dest Branch
	T429821 \| New addition to Hall of Fame, dependency updates	repos/sre/miscweb/security-landing-page!30	rscout	feature/hall-of-fame	master

Customize query in GitLab

Related Objects

Mentioned Here: T401099: CVE-2025-61638: Sanitizer::validateAttributes data-XSS

Event Timeline

sbassett created this task.Jun 22 2026, 5:16 PM

Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptJun 22 2026, 5:16 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Dreamy_Jazz moved this task from Inbox to Triaged (backlog) on the Product Safety and Integrity board.Jun 24 2026, 4:48 PM

sbassett changed the task status from Open to In Progress.Jun 29 2026, 4:24 PM

sbassett assigned this task to Rscout.

sbassett triaged this task as Low priority.

sbassett moved this task from Incoming to In Progress on the Security-Team board.

sbassett edited projects, added: SecTeam-Processed; removed: Product Safety and Integrity.

Pull request opened at https://gitlab.wikimedia.org/repos/sre/miscweb/security-landing-page/-/merge_requests/30

sbassett added a subscriber: CodeReviewBot.Jun 30 2026, 9:18 PM

sbassett updated https://gitlab.wikimedia.org/repos/sre/miscweb/security-landing-page/-/merge_requests/30

T429821 | New addition to Hall of Fame, dependency updates

rscout merged https://gitlab.wikimedia.org/repos/sre/miscweb/security-landing-page/-/merge_requests/30

T429821 | New addition to Hall of Fame, dependency updates

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".Jul 2 2026, 5:17 PM

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Low.

gui-ying233 subscribed.Jul 2 2026, 5:57 PM

gui-ying233 awarded a token.Jul 2 2026, 5:59 PM

sbassett closed this task as Resolved.Jul 2 2026, 6:16 PM

sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.

@Rscout For GHSA-4h5r-8rjm-496r, the Description seems to be wrong.

In T429821#12082579, @gui-ying233 wrote:

@Rscout For GHSA-4h5r-8rjm-496r, the Description seems to be wrong.

Yes, @Rscout, can you have a look?

sbassett moved this task from Our Part Is Done to In Progress on the Security-Team board.Jul 2 2026, 6:31 PM

Drat. New PR for review. https://gitlab.wikimedia.org/repos/sre/miscweb/security-landing-page/-/merge_requests/31

sbassett added a subscriber: gerritbot.Jul 2 2026, 8:05 PM

sbassett updated https://gitlab.wikimedia.org/repos/sre/miscweb/security-landing-page/-/merge_requests/31

fix: Copy/paste correct ticket title

https://gerrit.wikimedia.org/r/c/operations/deployment-charts/+/1307235 @sbassett

Change #1307235 had a related patch set uploaded (by SBassett; author: Rscout):

[operations/deployment-charts@master] chore: Deploy new version of security hall-of-fame

https://gerrit.wikimedia.org/r/1307235

gerritbot added a project: Patch-For-Review.Jul 2 2026, 8:30 PM

Change #1307235 merged by jenkins-bot:

[operations/deployment-charts@master] chore: Deploy new version of security hall-of-fame

https://gerrit.wikimedia.org/r/1307235

Rscout closed this task as Resolved.Jul 13 2026, 3:56 PM

sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.Jul 13 2026, 3:59 PM

sbassett removed a project: Patch-For-Review.

Consider adding gui-ying233 to Security Hall of FameClosed, ResolvedPublicSecurityActions

Description

Details

Related Objects

Event Timeline

Consider adding gui-ying233 to Security Hall of Fame
Closed, ResolvedPublicSecurity
Actions