CVE-2025-61657

N/A Unknown
Cross-Site Scripting

📋 TL;DR

This is a cross-site scripting (XSS) vulnerability in Wikimedia Foundation's Vector skin that allows attackers to inject malicious scripts into web pages. It affects users of MediaWiki sites running vulnerable Vector skin versions, potentially compromising user sessions and data.

💻 Affected Systems

Products:
  • Wikimedia Foundation Vector Skin
Versions: Vector skin versions from * before 1.43.4, 1.44.1
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Affects MediaWiki installations using the Vector skin with vulnerable versions. The vulnerability is in resources/skins.Vector.Js/stickyHeader.Js file.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal user credentials, session cookies, perform actions on behalf of users, or redirect to malicious sites, leading to complete account compromise.

🟠

Likely Case

Attackers inject malicious JavaScript to steal session cookies or credentials from logged-in users, potentially gaining unauthorized access to accounts.

🟢

If Mitigated

With proper Content Security Policy (CSP) headers and input validation, impact is limited to specific page contexts where the vulnerability exists.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

XSS vulnerabilities typically have low exploitation complexity. The vulnerability is in a JavaScript file that handles page generation, making it accessible to unauthenticated users.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Vector skin version 1.43.4 or 1.44.1

Vendor Advisory: https://phabricator.wikimedia.org/T398636

Restart Required: No

Instructions:

1. Update Vector skin to version 1.43.4 or 1.44.1. 2. For MediaWiki installations: Update via package manager or download from official repository. 3. Clear browser and server caches after update.

🔧 Temporary Workarounds

Disable Vector Skin

all

Temporarily switch to a different skin until patched

$wgDefaultSkin = 'timeless'; // In LocalSettings.php

Implement Content Security Policy

all

Add CSP headers to mitigate XSS impact

Header set Content-Security-Policy "default-src 'self'; script-src 'self'" // In .htaccess or server config

🧯 If You Can't Patch

  • Implement web application firewall (WAF) rules to block XSS payloads
  • Enable strict input validation and output encoding for all user inputs

🔍 How to Verify

Check if Vulnerable:

Check Vector skin version in MediaWiki installation. If version is earlier than 1.43.4 or 1.44.1, system is vulnerable.

Check Version:

Check $wgVectorSkinVersion in LocalSettings.php or skin version in MediaWiki interface

Verify Fix Applied:

Verify Vector skin version is 1.43.4 or 1.44.1. Test with XSS payloads to confirm sanitization.

📡 Detection & Monitoring

Log Indicators:

  • Unusual JavaScript injection attempts in web server logs
  • Suspicious characters like <script> in URL parameters

Network Indicators:

  • HTTP requests with JavaScript payloads in parameters
  • Unexpected script tags in page responses

SIEM Query:

web.url:*<script* OR web.url:*javascript:*

📊 Metadata

CVE ID: CVE-2025-61657
CVSS v3 Score: N/A (Unknown)
CWE: CWE-79
Published: February 3, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This