CVE-2025-61657
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...
CVE-2025-61657 is a none vulnerability (CVSS 0.0) in Wikimedia Foundation Vector, published February 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in mediawiki 1:1.43.6+dfsg-1~deb13u1.
- Severity
- 0.0 NoneCVSS 4.0, CVE List
- Exploit chance
- 0.30%EPSS, 22nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:1.43.6+dfsg-1~deb13u1mediawiki +8 more
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js.
This issue affects Vector: from * before 1.43.4, 1.44.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:13 | before 1:1.43.6+dfsg-1~deb13u1, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-1 | 1:1.43.6+dfsg-1~deb13u1 |
mediawikiDebian:14 | before 1:1.43.5+dfsg-1, plus listed versions 1:1.43.3+dfsg-1 | 1:1.43.5+dfsg-1 |
mediawikiUbuntu:18.04:LTS | All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 | None known |
mediawikiUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:Pro:22.04:LTS | All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:Pro:24.04:LTS | All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:25.10 | All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 | None known |
mediawikiUbuntu:26.10 | All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 | None known |
mediawikiUbuntu:26.04:LTS | All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2 | None known |
What each source reports
CVE List Score used
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js.
This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
CVE-2025-61657- CVSS 4.0
- 0.0 None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-206653No score
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js.
This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
EUVD-2025-206653- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gx5g-5pq5-7v27
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js.
This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
GHSA-gx5g-5pq5-7v27- CVSS 4.0
- 0.0 None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js.
This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
CVE-2025-61657- CVSS 4.0
- 0.0 None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-61657
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
DEBIAN-CVE-2025-61657- CVSS 4.0
- 0.0 None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-61657
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.
- Record
UBUNTU-CVE-2025-61657- CVSS 4.0
- 0.0 None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.