Wikimedia Foundation MediaWiki Core Feed Utils WebView Injection Vulnerability

A vulnerability allowing improper encoding or escaping of output has been identified in the Feed Utils component of Wikimedia Foundation's MediaWiki Core, specifically in versions 1.39 through 1.43. This issue can lead to WebView injection by allowing HTML injection in the feed output.

Impact

Exploitation of this vulnerability could cause HTML injection, leading to malformed or confusing feed output.

Reproduction

The vulnerability can be reproduced by creating a blank wikitext page, which triggers the 'newpage' message. This message is then included in the feed output without proper escaping. When the feed is viewed with a WebView that interprets HTML, such as in a mobile app, the injected script will execute, demonstrating the WebView injection vulnerability.

Remediation

Users can update to MediaWiki versions 1.39.12, 1.42.6, or 1.43.1, where this vulnerability has been patched.