CVE-2025-61650
Cross-Site Scripting in Wikimedia CheckUser UserInfoCard Service
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wikimedia | checkuser | to 795bf333272206a0189050d975e94b70eb7dc507 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow attackers to inject and execute malicious JavaScript code in the context of the affected MediaWiki CheckUser UserInfoCard. This could lead to unauthorized actions such as session hijacking, defacement, or other malicious activities executed in the user's browser when viewing the UserInfoCard. However, the risk rating assigned to this vulnerability is low. [1]
Can you explain this vulnerability to me?
CVE-2025-61650 is a stored Cross-Site Scripting (XSS) vulnerability in the UserInfoCard feature of the CheckUser extension for MediaWiki. It occurs because unsafe handling of message keys related to user groups allows malicious JavaScript payloads to be injected and stored. When the UserInfoCard is rendered, these scripts execute, potentially triggering actions like JavaScript alerts. The vulnerability was hard to detect with standard X-XSS tests and required special payloads for detection. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is difficult to detect using standard X-XSS language tests because script tags injected post-DOM load do not execute. Detection involves testing for stored Cross-Site Scripting (XSS) in the UserInfoCard feature by injecting alternative payloads such as <img src="" onerror="alert(1)"> into message keys related to user groups (e.g., "checkuser-userinfocard-groups" and "checkuser-userinfocard-global-groups"). There are no specific commands provided, but testing should focus on injecting and rendering such payloads in the UserInfoCard to observe if JavaScript executes. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the security patch developed for the CheckUser extension that escapes unsafe inputs in message keys to prevent script execution. This patch has been merged into the master branch and backported to stable branches (wmf.16 and wmf.17). Updating your CheckUser extension to the patched version will mitigate the vulnerability. Additionally, coordinate with your deployment team to ensure the patch is applied and tested before release. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know