CVE-2025-6594: XSS in Special:ApiSandbox

Q: What is the severity of CVE-2025-6594?

CVE-2025-6594 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2025-6594?

To fix CVE-2025-6594, update your Wikimedia Foundation MediaWiki installation to a version above 1.39.12.

Q: What products are affected by CVE-2025-6594?

CVE-2025-6594 affects all versions of Wikimedia Foundation MediaWiki from 1.27.0 to 1.39.12.

Q: What type of vulnerability is CVE-2025-6594?

CVE-2025-6594 is an XSS (Cross-site Scripting) vulnerability involving improper input neutralization.

Q: Is there a workaround for CVE-2025-6594?

Currently, there are no documented workarounds for CVE-2025-6594; the best course of action is to apply the software update.

Published Feb 2, 2026

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js.

This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki>1.27.0<=1.39.12

Event History

Feb 2, 2026

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionWeakness

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-6594?

CVE-2025-6594 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2025-6594?

To fix CVE-2025-6594, update your Wikimedia Foundation MediaWiki installation to a version above 1.39.12.

What products are affected by CVE-2025-6594?