[MediaWiki] [MediaWiki-announce] MediaWiki Extensions and Skins Security Release Supplement (1.39.16/1.43.6/1.44.3/1.45.1)

Produit : MediaWiki

Type : Release / Sécurité

CVE : CVE-2025-62508, CVE-2026-0668, CVE-2026-0669, CVE-2026-0671, CVE-2026-0670, CVE-2026-22710, CVE-2026-22714, CVE-2026-22713, CVE-2026-22712, CVE-2026-0817

Date source : 09/01/2026 17:54

Résumé :
Greetings-

With the security/maintenance release of MediaWiki
1.39.16/1.43.6/1.44.3/1.45.1, we would also like to provide this
supplementary announcement of MediaWiki extensions and skins with
now-public Phabricator tasks, security patches and backports [1]:

Citizen
+ (GHSA-g955-vw6w-v6pp, CVE-2025-62508) – Stored XSS in sticky header
button messages
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp

VisualData
+ (T387008, CVE-2026-0668) – VisualData extension: Regular Expression
Denial of Service (ReDoS) via crafted user input
https://gerrit.wikimedia.org/r/q/Ie08d9a8ceb2c9a22a635cfc27964353f14072dbf
https://gerrit.wikimedia.org/r/q/Ifbf9c2ade621226e14fe852f3217293772bf8bb8
https://gerrit.wikimedia.org/r/q/I893a9fca694a2613e29e149dea2d76d7f06063e5
https://gerrit.wikimedia.org/r/q/I4ff2737c9f0ba805267d1fc8296e7cff61241ee3

CSS
+ (T40152

Action recommandée :
Vérifier la version installée et appliquer le correctif si le produit est concerné.

Source : Voir l’annonce officielle