Description
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.35.0-1 | — |
| Debian 13 | mediawiki | 1:1.35.0-1 | — |
| Debian 12 | mediawiki | 1:1.35.0-1 | — |
| Debian 10 | mediawiki | 1:1.31.10-1~deb10u1 | DSA-4767-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mediawiki | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | mediawiki | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mediawiki/core | >= 1.34.0, < 1.34.3 | 1.34.3 | GHSA-rj9p-8jxj-2ch4 |
| Packagist | mediawiki/core | >= 1.35.0-rc.0, < 1.35.0 | 1.35.0 | GHSA-rj9p-8jxj-2ch4 |
Advisories 1
- DSA-4767-1 mediawiki - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://gerrit.wikimedia.org/g/mediawiki/core/+/ad4a3ba45fb955aa8c0eb3c83809b16b40a498b9/includes/specials/SpecialContributions.php#592
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html
- FEDORA-2020-a4802c53d9 vendor-advisory