MediaWiki CheckUser Extension i18n XSS Vulnerability (CVE-2025-53480) Fix

Key Information Vulnerability Overview CVE ID: CVE-2025-53480 Vulnerability Type: i18n XSS (Internationalization Cross-Site Scripting) Affected Component: Special:Investigate 'Account information' tab in CheckUser extension Background Issue Description: When using i18n languages, Special:Investigate in the 'Account information' tab is vulnerable to i18n XSS attacks due to improper handling of XSS language content. Specific Scenario: When a user conducts a Special:Investigate inquiry using an XSS language, multiple alert boxes pop up, indicating that the page may be abused. Acceptance Criteria Fix Goal: Ensure that the CheckUser Special:Investigate 'Account information' tab is no longer vulnerable to i18n XSS attacks. Risk Rating Risk Level: Low Related Commits Fix Commits: - SECURITY: Fix i18n XSS in PreliminaryCheckPager (master branch) - SECURITY: Fix i18n XSS in PreliminaryCheckPager (REL1_42 branch) - SECURITY: Fix i18n XSS in PreliminaryCheckPager (REL1_43 branch) - SECURITY: Fix i18n XSS in PreliminaryCheckPager (REL1_44 branch) - SECURITY: Fix i18n XSS in PreliminaryCheckPager (REL1_39 branch) Timeline Creation Date: May 19, 2025 Status Changes: - From Open to In Progress (May 27, 2022) - From In Progress to Resolved (June 10, 2022) - Reopened (June 14, 2022) Notes Notes: Merged into master and backported to other branches.

Goal Reached Thanks to every supporter — we hit 100%!

MediaWiki CheckUser Extension i18n XSS Vulnerability (CVE-2025-53480) Fix