gui-ying233/cve-2025-61638Proof-of-concept exploit for CVE-2025-61638, a stored XSS vulnerability in MediaWiki's Sanitizer::validateAttributes. Tests for the flaw across vulnerable wiki instances via API.
node . "https://www.mediawiki.org/w/api.php" (fixed)
More exploitable targets can be found at https://www.mediawiki.org/wiki/Sites_using_MediaWiki.
https://phabricator.wikimedia.org/T401099
https://www.cve.org/CVERecord?id=CVE-2025-61638
XSS attack requires editing entries, so at least xss !== false and reg: true are needed. anno: true means anonymous (IP) users, which can enhance attack capability.
Since some wikis have additional protections such as WAF, the script only tests the vulnerability and does not provide bypass attempts for actual attacks.
It is worth noting that although fixes were provided in versions 1.39, 1.43, and 1.44, this vulnerability has existed for a long time (15 years). Almost all versions of these three LTS releases before the fix are vulnerable.
Read more: CVE-2025-61638: Sanitizer::validateAttributes data-XSS
