Nixpkgs security tracker

Published

Permalink CVE-2025-67481

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T251032

Affected products

MediaWiki

<1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-67475

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Stored XSS through edit summaries in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T406664

Affected products

MediaWiki

<1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-67476

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Importing leaks IP address of importer via EventStreams

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T405859

Affected products

MediaWiki

<1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-67484

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T401995

Affected products

MediaWiki

<1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Dismissed

Permalink CVE-2025-67480

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse dismissed 5 months, 4 weeks ago

list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T401053

Affected products

MediaWiki

<1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

This extension does not seem present in nixpkgs

Published

Permalink CVE-2025-67483

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T409226

Affected products

MediaWiki

<1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-67477

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Stored XSS through a system message in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

References

https://phabricator.wikimedia.org/T406639

Affected products

MediaWiki

<1.44.3, 1.45.1

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-11261

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Stored i18n XSS exposed by security patch for T402077

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

References

Affected products

MediaWiki

<1.39.15, 1.43.5, 1.44.2

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Published

Permalink CVE-2025-61644

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

i18n XSS through Special:Watchlist

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.

References

https://phabricator.wikimedia.org/T403411

Affected products

MediaWiki

<> fb856ce9cf121e046305116852cca4899ecb48ca

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.45.0
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Apparently fixed after https://github.com/wikimedia/mediawiki/commit/fb856ce9cf121e046305116852cca4899ecb48ca (MW 1.45.1)

Untriaged

Permalink CVE-2025-6589

created 6 months ago Activity log

Created suggestion 6 months ago

With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0.

References

https://phabricator.wikimedia.org/T391343

Affected products

MediaWiki

==>= 1.42.0

Matching in nixpkgs

pkgs.mediawiki

Collaborative editing software that runs Wikipedia

nixos-unstable 1.44.2
- nixpkgs-unstable 1.45.0
- nixos-unstable-small 1.45.0

Package maintainers

@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mediawiki

Package maintainers