CVE-2025-61640: MediaWiki XSS Vulnerability

CVE-2025-61640 Overview

CVE-2025-61640 is a Cross-Site Scripting (XSS) vulnerability affecting Wikimedia Foundation MediaWiki. The vulnerability stems from improper neutralization of input during web page generation in the RclToOrFromWidget.js file within the MediaWiki Recent Changes filters UI component. This flaw allows attackers to inject malicious scripts through user-controllable input that is not properly sanitized before being rendered in web pages.

Critical Impact

Attackers could potentially execute arbitrary JavaScript in the context of authenticated MediaWiki users, leading to session hijacking, content manipulation, or theft of sensitive information.

Affected Products

• MediaWiki versions before 1.39.14
• MediaWiki versions before 1.43.4
• MediaWiki versions before 1.44.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-61640 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-61640

Vulnerability Analysis

This vulnerability exists in the MediaWiki Recent Changes filters user interface, specifically within the resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.js JavaScript component. The RclToOrFromWidget handles user filtering operations for the Recent Changes page, a core feature that allows wiki users to track and filter edits made across the platform.

The vulnerability arises from insufficient input validation and output encoding when user-supplied data is processed and rendered by the widget. When user input passes through the RclToOrFromWidget without proper sanitization, malicious JavaScript code can be injected and executed in the browser context of other users viewing the affected pages.

Root Cause

The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The RclToOrFromWidget.js component fails to properly sanitize or encode user-controllable input before incorporating it into the Document Object Model (DOM). This allows specially crafted input containing JavaScript code to be interpreted and executed by the victim's browser rather than being treated as plain text data.

Attack Vector

The attack vector is network-based, requiring an attacker to craft malicious input that reaches the vulnerable widget component. The exploitation scenario typically involves an authenticated attacker with the ability to influence content that passes through the Recent Changes filter system. When other users interact with the affected interface elements, the injected script executes within their browser session.

The vulnerability requires user interaction for successful exploitation, as victims must access or interact with the compromised widget interface. Additionally, the attacker requires elevated privileges to position the malicious payload where it can be processed by the vulnerable component.

The attack flow involves the attacker submitting crafted input containing malicious JavaScript, the vulnerable widget processing this input without adequate sanitization, and ultimately the victim's browser executing the injected script when rendering the affected page content.

Detection Methods for CVE-2025-61640

Indicators of Compromise

• Unusual JavaScript execution or DOM manipulation attempts in MediaWiki Recent Changes pages
• Log entries showing suspicious filter parameters or encoded script content in URL parameters
• User reports of unexpected browser behavior or pop-ups when using Recent Changes functionality

Detection Strategies

• Monitor web application logs for requests containing suspicious script tags or JavaScript event handlers in filter-related parameters
• Implement Content Security Policy (CSP) violation logging to detect attempted script injection
• Deploy web application firewall (WAF) rules to flag requests with XSS payload patterns targeting MediaWiki endpoints

Monitoring Recommendations

• Enable verbose logging for the MediaWiki Recent Changes module to capture filter parameter values
• Configure real-time alerting for CSP violations originating from MediaWiki installations
• Regularly audit user activity logs for accounts submitting unusual or encoded content to filter interfaces

How to Mitigate CVE-2025-61640

Immediate Actions Required

• Upgrade MediaWiki to version 1.39.14, 1.43.4, or 1.44.1 (or later) depending on your current release branch
• Review and audit any customizations to the Recent Changes filter components
• Consider temporarily disabling or restricting access to Recent Changes filters for untrusted users until patching is complete

Patch Information

Wikimedia Foundation has released security patches addressing this vulnerability. Detailed information about the fix is available in the Wikimedia Task T402075. Organizations running affected MediaWiki versions should update to the patched releases:

• Version 1.39.14 for the 1.39.x LTS branch
• Version 1.43.4 for the 1.43.x branch
• Version 1.44.1 for the 1.44.x branch

Workarounds

• Implement a Content Security Policy (CSP) with strict script-src directives to limit script execution sources
• Deploy WAF rules to filter common XSS patterns in requests to MediaWiki endpoints
• Restrict access to the Recent Changes interface to trusted authenticated users only until patches can be applied

# Example Content Security Policy header configuration for Apache
# Add to your MediaWiki virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"