VYPR
← All advisories
High severity8.6OSV Advisory· Published Sep 15, 2025· Updated Apr 15, 2026

CVE-2025-59332

CVE-2025-59332

Description

3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.

Affected products

1

Patches

1
9fac79362548

Merge commit from fork

https://github.com/dolfinus/3dalloyMaxim MartynovSep 8, 2025via osv
commit
1 file changed · +8 −0
  • 3DAlloy_body.php+8 −0 modified
    @@ -103,6 +103,10 @@ static public function parse3DTag($input, array $args, Parser $parser, PPFrame $
       }
     }
 
+    $par = Sanitizer::validateAttributes( $par, [
+      'file', 'width', 'height', 'color', 'opacity', 'zoom', 'pan', 'norotate', 'scale', 'z', 'style', 'class',
+    ] );
+
     $elem = Html::element('canvas', $par, $input);
 
     return [ $elem, 'noParse'=> true, 'isHTML'=> 'true' ];
@@ -152,6 +156,10 @@ static public function parse3DFunc(Parser &$parser) {
       }
     }
 
+    $par = Sanitizer::validateAttributes( $par, [
+      'file', 'width', 'height', 'color', 'opacity', 'zoom', 'pan', 'norotate', 'scale', 'z', 'style', 'class',
+    ] );
+
     $elem = Html::element('canvas', $par, $params["file"]);
 
     return [ $elem, 'noParse'=> true, 'isHTML'=> 'true' ];

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.