VYPR
← All advisories
Medium severity4.8OSV Advisory· Published Feb 3, 2026· Updated Jun 17, 2026

CVE-2025-61638

CVE-2025-61638

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php.

This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Wikimedia Foundation/MediawikiOSV2 versions
    0.12.0-a1, 0.19.0-a14, 1.1.0, …+ 1 more
    • (no CPE)range: 0.12.0-a1, 0.19.0-a14, 1.1.0, …
    • (no CPE)range: <1.39.14, 1.43.4, 1.44.1
  • MediaWiki/Mediawiki
    cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
    Range: <1.39.14
  • Wikimedia Foundation/Parsoid2 versions
    cpe:2.3:a:wikimedia:parsoid:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:wikimedia:parsoid:*:*:*:*:*:node.js:*:*range: <0.16.6
    • (no CPE)range: <0.16.6, 0.20.4, 0.21.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.