https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:46:34.949611+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-246414 EUVD-2026-246414 2026-10-04T20:46:34.952598+00:00 EUVD-2026-246414 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53369 fkie_cve-2025-53369 2026-10-04T20:46:34.952629+00:00

Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-p85q-mww9-gwqf GHSA-p85q-mww9-gwqf — Citizen Short Description stored XSS vulnerability through wikitext 2026-10-04T20:46:34.952666+00:00

Affected: Packagist: starcitizentools/short-description

### Summary Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using `mw.util.addSubtitle`, allowing any user to insert arbitrary HTML into the DOM by editing a page.

### Details The description provided by the user via the `{{SHORTDESC:}}` parser function is insufficiently sanitized by the `sanitize()` function, as html entities are decoded: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159 Via JS, the short description is then passed to `mw.util.addSubtitle`, which inserts it as raw HTML: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8 https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563

### PoC 1. Enable ShortDescription 2. Make sure `$wgShortDescriptionEnableTagline` is set to `true` (this is the default) 3. Create a page and insert the following wikitext: `{{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}}` 4. Visit the page

![image](https://github.com/user-attachments/assets/8e467f28-3bb5-4462-b28b-14e145be743f) ![image](https://github.com/user-attachments/assets/39e132c3-6a92-4f24-8aef-b915e8560f63)

### Impact Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be execut…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1525 WID-SEC-W-2025-1525 — MediaWiki Extensions und Skins: Mehrere Schwachstellen 2026-10-04T20:46:34.952708+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um SQL-Injection- und XSS-Angriffe durchzuführen, Sicherheitsmechanismen zu umgehen, vertrauliche Informationen offenzulegen oder sich unbefugt höhere Berechtigungen zu verschaffen.