CVE-2025-67481: MediaWiki XSS Vulnerability

CVE-2025-67481 Overview

CVE-2025-67481 is a Cross-Site Scripting (XSS) vulnerability in Wikimedia Foundation MediaWiki. The flaw resides in the resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js component, which handles message parsing on the client side. The issue stems from improper neutralization of input during web page generation, classified as [CWE-79].

Affected releases include MediaWiki versions prior to 1.39.16, 1.43.6, 1.44.3, and 1.45.1. Exploitation requires high privileges on the target wiki, limiting opportunistic abuse but exposing administrative and editor accounts as viable attack paths.

Critical Impact

Authenticated attackers with high privileges can inject script payloads through the jQuery message handler, executing arbitrary JavaScript in the browsers of other MediaWiki users.

Affected Products

• MediaWiki versions before 1.39.16
• MediaWiki versions before 1.43.6 and 1.44.3
• MediaWiki version 1.45.0 (fixed in 1.45.1)

Discovery Timeline

• 2026-02-03 - CVE-2025-67481 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2025-67481

Vulnerability Analysis

The vulnerability exists in the mediawiki.JqueryMsg.Js resource module. This client-side component parses MediaWiki message strings that contain wikitext-like markup and converts them into DOM nodes through jQuery operations. Improper neutralization in the parsing routine allows attacker-controlled input to be rendered as executable HTML or JavaScript in the user's browser context.

Because MediaWiki messages can be modified through the MediaWiki: namespace, which is typically restricted to administrators or interface editors, exploitation requires elevated privileges. Once injected, the payload runs in the security context of any user whose page loads the malicious message, enabling session theft, CSRF actions against the wiki, and account takeover of higher-privileged users.

Root Cause

The root cause is insufficient output encoding within the jQuery message parser. The component constructs DOM elements from message strings without consistently sanitizing untrusted segments, allowing HTML tags or event handlers embedded in message content to be interpreted by the browser rather than treated as literal text.

Attack Vector

The attack vector is network-based and authenticated. An attacker with administrator or interface-editor rights modifies a system message containing a crafted XSS payload. When other users load any page that renders that message through mediawiki.JqueryMsg, the payload executes. Refer to the Wikimedia Task T251032 for technical context.

Detection Methods for CVE-2025-67481

Indicators of Compromise

• Edits to pages within the MediaWiki: namespace containing HTML tags, <script> elements, or inline event handlers such as onerror= or onclick=.
• Unexpected administrator or interface-editor activity modifying interface messages outside normal maintenance windows.
• Browser console errors or Content Security Policy violations originating from MediaWiki message rendering.

Detection Strategies

• Audit MediaWiki revision logs for changes to system messages and compare current content against known-good baselines.
• Monitor outbound requests from authenticated user sessions to unexpected domains, indicating possible XSS-driven data exfiltration.
• Enable and review Content Security Policy reports for inline script execution blocked on MediaWiki pages.

Monitoring Recommendations

• Forward MediaWiki application logs and web server access logs to a centralized logging platform for correlation.
• Alert on bulk edits to the MediaWiki: namespace or rapid privilege changes preceding message edits.
• Track anomalous session activity from administrator accounts, including impossible-travel logins and unusual API token use.

How to Mitigate CVE-2025-67481

Immediate Actions Required

• Upgrade MediaWiki to version 1.39.16, 1.43.6, 1.44.3, or 1.45.1 or later, depending on the deployed release branch.
• Review all recent edits to the MediaWiki: namespace and revert any unauthorized modifications.
• Rotate session tokens and credentials for accounts with editinterface rights if compromise is suspected.

Patch Information

Wikimedia Foundation has published fixed releases on the 1.39, 1.43, 1.44, and 1.45 branches. Administrators should apply the corresponding patched version that matches their current branch. Technical details are available in Wikimedia Task T251032.

Workarounds

• Restrict the editinterface user right to a minimal set of trusted accounts until patching is complete.
• Deploy a strict Content Security Policy that disallows inline scripts and unsafe-eval on MediaWiki pages.
• Temporarily disable or audit custom interface messages that incorporate user-supplied parameters.