Description
The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.15.5-5 | — |
| Debian 13 | mediawiki | 1:1.15.5-5 | — |
| Debian 12 | mediawiki | 1:1.15.5-5 | — |
| Debian 6.0 | mediawiki | 1:1.15.5-2squeeze2 | DSA-2366-1 |
| Debian 5.0 | mediawiki | 1:1.12.0-2lenny9 | DSA-2366-1 |
Advisories 1
- DSA-2366-1 mediawiki - multiple Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2011-5495 vendor-advisory
- https://bugzilla.wikimedia.org/show_bug.cgi?id=28450
- ADV-2011-0978 vdb-entry
- http://www.mediawiki.org/wiki/Special:Code/MediaWiki/85856
- FEDORA-2011-5807 vendor-advisory
- 47354 vdb-entry
- 44142 third-party-advisory
- FEDORA-2011-5848 vendor-advisory
- ADV-2011-1151 vdb-entry
- mediawiki-css-data-xss(66738) vdb-entry
- DSA-2366 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=696360
- [mediawiki-announce] 20110412 MediaWiki security release 1.16.3 mailing-list
- ADV-2011-1100 vdb-entry
- FEDORA-2011-5812 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=695577
- [oss-security] 20110413 Re: CVE request: mediawiki 1.16.3 mailing-list