CVE-2025-67475

A stored cross-site scripting (XSS) vulnerability exists in MediaWiki's CommentFormatter component, specifically in the CommentParser.php file [1]. The vulnerability is caused by improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary HTML or JavaScript code that will be executed when other users view the affected comment [1].

To exploit this issue, an attacker must have the ability to post or edit comments on a MediaWiki site. The vulnerability does not require authentication beyond normal user privileges, but the attacker must be able to submit input that is stored and later rendered as part of a comment [1]. The attack vector is network-based, and user interaction, and the scope is changed, meaning the injected script could affect other pages outside the comment itself.

The impact includes potential disclosure of sensitive session cookies, page redirection, or other malicious actions. The CVSS v3 base score is 6.1 (Medium), with low attack complexity and low privileges required [1].

Mitigation is available by upgrading to MediaWiki versions 1.39.16, 1.43.6, 1.44.3, 1.45.1 or later, which include the fix. No workarounds have been publicly documented, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog [1].