Executive brief
A vulnerability in the ProofreadPage extension for MediaWiki allows attackers to inject malicious CSS code into wiki pages. This could lead to unauthorized data tracking or the loading of external resources when users view or edit affected pages. The issue has been resolved in recent updates to MediaWiki.
Technical details
The ProofreadPage extension improperly sanitizes multiline styles using Sanitizer::checkCSS before decoding HTML entities. This flaw allows attackers to bypass security filters by using HTML entities to hide dangerous CSS syntax such as @import and url() functions. Because Sanitizer::checkCSS is designed for inline style attributes rather than multiline <style> blocks, it fails to block certain at-rules. Attackers can exploit this to load external resources or perform XSS targeting non-script elements. The vulnerability has been remediated by switching to the wikimedia/css-sanitizer library in MediaWiki versions 1.43, 1.44, and 1.45.
Affected products
- Wikimedia Foundation MediaWiki - ProofreadPage Extension < 1.43, < 1.44, < 1.45
Timeline
- 2025-10-01: disclosed: Initial report in Phabricator (T406088)
- 2026-04-07: advisory: CVE published and remediation announced