PT-2025-27764 · Wikimedia Foundation+2 · Vector+1

Published 2025-07-02 · Updated 2026-02-02 · CVE-2025-6596

Positive Technologies (AI Summary)

CVSS v4.0

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Vector versions 1.40.0 through 1.42.6 Wikimedia Foundation Vector version 1.43.0 Wikimedia Foundation Vector version 1.43.1 Wikimedia Foundation Vector version 1.44.0

Description The software contains an Improper Neutralization of Input During Web Page Generation issue, also known as Cross-site Scripting (XSS). This issue is found in the program files resources/skins.Vector.Js/portlets.Js and resources/skins.Vector.Legacy.Js/portlets.Js.

Recommendations Update to Vector version 1.42.7 or later. Update to Vector version 1.43.2 or later. Update to Vector version 1.44.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-6596

Affected Products

Vector

Mediawiki

References · 10

• https://cve.org/CVERecord?id=CVE-2025-6596 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-6596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6596 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6596 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6596 · Vendor Advisory
• https://twitter.com/CVEnew/status/2018465503610552565 · Twitter Post
• https://lists.wikimedia.org/hyperkitty/list/[e-mail]/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U · Note
• https://phabricator.wikimedia.org/T396685 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/skins/Vector/+/1165107 · Note