CVE-2025-53369: MediaWiki Short Description XSS Flaw

CVE-2025-53369 Overview

CVE-2025-53369 is a Cross-Site Scripting (XSS) vulnerability in the Short Description extension for MediaWiki, which provides local short description support for wiki pages. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using the mw.util.addSubtitle function, allowing any authenticated user to inject arbitrary HTML into the Document Object Model (DOM) by editing a page.

Critical Impact

This XSS vulnerability enables attackers to execute malicious JavaScript in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or defacement of wiki content.

Affected Products

• MediaWiki Short Description Extension version 4.0.0

Discovery Timeline

• 2025-07-03 - CVE-2025-53369 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53369

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in the client-side JavaScript module ext.shortDescription.js, where user-controlled short description content is passed directly to mw.util.addSubtitle() without any HTML encoding or sanitization.

When a user edits a MediaWiki page and includes malicious HTML or JavaScript in the short description field, this content is rendered directly into the DOM of any page visitor. Since the vulnerability exists in the subtitle rendering logic, the malicious payload executes in the security context of the MediaWiki domain, giving attackers access to session cookies, authentication tokens, and the ability to perform actions on behalf of the victim user.

Root Cause

The root cause is missing output encoding in the JavaScript module responsible for rendering short descriptions. The shortdesc variable containing user-supplied content was passed directly to mw.util.addSubtitle() without first being sanitized through MediaWiki's built-in mw.html.escape() function. This allowed raw HTML and script tags to be interpreted by the browser rather than displayed as plain text.

Attack Vector

The attack is network-based and requires no privileges or user interaction beyond the victim viewing a page with a malicious short description. An attacker with edit permissions on the wiki can craft a page with a specially crafted short description containing JavaScript payloads. When other users view the page, the malicious script executes in their browser context, enabling:

• Session cookie theft and account takeover
• Keylogging of sensitive form inputs
• Phishing attacks through injected content
• Spreading of self-propagating worms through automated page edits

// Security patch in modules/ext.shortDescription.js
// Source: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bc4fdbaeb1dff127fb6d08c0d385b64aa128c8f8

 		return;
 	}
 
-	mw.util.addSubtitle( shortdesc );
+	mw.util.addSubtitle( mw.html.escape( shortdesc ) );
}

main();

The fix wraps the shortdesc variable with mw.html.escape() to ensure all HTML special characters are properly encoded before DOM insertion, preventing script execution.

Detection Methods for CVE-2025-53369

Indicators of Compromise

• Unusual or obfuscated content in short description fields across wiki pages
• JavaScript payloads containing <script> tags, event handlers (e.g., onerror, onload), or javascript: URIs in page metadata
• Reports of unexpected browser behavior or popup dialogs when viewing wiki pages
• Unauthorized session activity or account actions correlating with page views

Detection Strategies

• Implement Content Security Policy (CSP) headers with strict script-src directives to detect and block inline script execution
• Deploy web application firewalls (WAF) with XSS detection rules monitoring for HTML injection patterns in form submissions
• Review MediaWiki database for short description entries containing HTML tags or JavaScript constructs
• Enable browser-side XSS auditing and monitor security console warnings

Monitoring Recommendations

• Configure logging for MediaWiki page edits with focus on short description field modifications
• Implement real-time alerting for CSP violation reports indicating XSS attempts
• Monitor user-agent logs for automated tools commonly used in XSS exploitation
• Establish baseline behavior for page edit patterns to detect anomalous bulk modifications

How to Mitigate CVE-2025-53369

Immediate Actions Required

• Upgrade the Short Description extension to version 4.0.1 or later immediately
• Audit existing wiki pages for potentially malicious short description content
• Review recent page edit history to identify any exploitation attempts
• Consider temporarily disabling the Short Description extension if immediate patching is not possible

Patch Information

The vulnerability has been patched in version 4.0.1 of the Short Description extension. The fix implements proper HTML escaping using MediaWiki's mw.html.escape() function before inserting short descriptions into the DOM. Organizations should update to the patched version through their standard MediaWiki extension update process.

For detailed patch information, refer to the GitHub Commit and the GitHub Security Advisory.

Workarounds

• Disable the Short Description extension entirely until patching is possible by removing it from LocalSettings.php
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Restrict page editing permissions to trusted users only while the vulnerable version is deployed
• Deploy a reverse proxy or WAF rule to strip HTML tags from short description form fields

# Configuration example - Disable Short Description extension in LocalSettings.php
# Comment out or remove the following line:
# wfLoadExtension( 'ShortDescription' );

# Add Content Security Policy headers in Apache/Nginx as defense-in-depth:
# Apache: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
# Nginx: add_header Content-Security-Policy "default-src 'self'; script-src 'self'";