CVE-2025-6596

N/A Unknown
Cross-Site Scripting

📋 TL;DR

This is a cross-site scripting (XSS) vulnerability in Wikimedia's Vector skin that allows attackers to inject malicious scripts into web pages. It affects MediaWiki installations using Vector skin versions 1.40.0 through 1.42.6, 1.43.0-1.43.1, and 1.44.0. Attackers could execute arbitrary JavaScript in users' browsers when they view specially crafted pages.

💻 Affected Systems

Products:
  • MediaWiki Vector Skin
Versions: Vector skin versions >=1.40.0 before 1.42.7, 1.43.2, 1.44.0
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects MediaWiki installations using Vector skin. Vector is the default skin for MediaWiki since version 1.16.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal session cookies, perform actions as authenticated users, deface pages, or redirect users to malicious sites.

🟠

Likely Case

Session hijacking, credential theft, or limited page defacement through script injection.

🟢

If Mitigated

Minimal impact if Content Security Policy (CSP) is properly configured and input validation is enforced.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

XSS vulnerabilities typically have low exploitation complexity. The vulnerability is in portlets.js files which handle page elements.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Vector skin versions 1.42.7, 1.43.2, or 1.44.0

Vendor Advisory: https://phabricator.wikimedia.org/T396685

Restart Required: No

Instructions:

1. Update MediaWiki to latest version. 2. Update Vector skin to patched version. 3. Clear browser caches. 4. Verify the fix by checking Vector skin version.

🔧 Temporary Workarounds

Disable Vector Skin

all

Switch to a different MediaWiki skin temporarily

$wgDefaultSkin = 'timeless'; // In LocalSettings.php

Content Security Policy

all

Implement strict CSP headers to mitigate XSS impact

Header set Content-Security-Policy "default-src 'self'; script-src 'self'" // Apache .htaccess

🧯 If You Can't Patch

  • Implement strict input validation and output encoding for all user inputs
  • Deploy web application firewall (WAF) with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check Vector skin version in MediaWiki Special:Version page or examine resources/skins.Vector.js/portlets.js file version

Check Version:

grep -r 'Vector.*version' /path/to/mediawiki/skins/Vector/ || php /path/to/mediawiki/maintenance/showSkinVersion.php --skin=Vector

Verify Fix Applied:

Verify Vector skin version is 1.42.7, 1.43.2, or 1.44.0+ in Special:Version

📡 Detection & Monitoring

Log Indicators:

  • Unusual JavaScript in page requests
  • Suspicious input patterns in portlet-related parameters

Network Indicators:

  • Script injection attempts in HTTP requests
  • Malformed portlet parameter values

SIEM Query:

web_request WHERE url_path CONTAINS 'portlet' AND (request_body CONTAINS '<script>' OR request_body CONTAINS 'javascript:')

📊 Metadata

CVE ID: CVE-2025-6596
CVSS v3 Score: N/A (Unknown)
CWE: CWE-79
Published: February 2, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This