CVE-2020-25828: XSS
An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)
Other sources
An issue was discovered in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)
— GitHub
Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25828?
CVE-2020-25828 has been classified as a medium severity vulnerability due to its potential for XSS attacks through unescaped HTML.
What versions are affected by CVE-2020-25828?
CVE-2020-25828 affects MediaWiki versions before 1.31.10 and versions between 1.32.x and 1.34.x before 1.34.4.
How do I fix CVE-2020-25828?
To fix CVE-2020-25828, update MediaWiki to version 1.31.10, 1.34.4, or a later version.
What type of vulnerability is CVE-2020-25828?
CVE-2020-25828 is a cross-site scripting (XSS) vulnerability caused by the mw.message().parse() function not escaping HTML.
Is there a workaround for CVE-2020-25828?
There is no known workaround for CVE-2020-25828; updating to a patched version is recommended to mitigate the vulnerability.