CVE-2020-25814

In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked.

• CWE-79

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Release Notes, Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Release Notes, Vendor Advisory
• https://www.mediawiki.org/wiki/ResourceLoader/Core_modules#mediawiki.jqueryMsgVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Release Notes, Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Release Notes, Vendor Advisory
• https://www.mediawiki.org/wiki/ResourceLoader/Core_modules#mediawiki.jqueryMsgVendor Advisory

Published

Sep 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2580Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-25802Improper Control of Dynamically-Managed Code Resources vulne…7.2
• CVE-2020-25803Improper Control of Dynamically-Managed Code Resources vulne…7.2
• CVE-2020-2581Vulnerability in the Oracle GraalVM Enterprise Edition produ…4
• CVE-2020-25812An issue was discovered in MediaWiki 1.34.x before 1.34.4. O…6.1
• CVE-2020-25813In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before…5.3
• CVE-2020-25815An issue was discovered in MediaWiki 1.32.x through 1.34.x b…6.1
• CVE-2020-25816HashiCorp Vault and Vault Enterprise versions 1.0 and newer …6.8
• CVE-2020-25817SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in C…4.8
• CVE-2020-2582Vulnerability in the Oracle iStore product of Oracle E-Busin…8.2
• CVE-2020-25820BigBlueButton before 2.2.7 allows remote authenticated users…6.5
• CVE-2020-25821peg-markdown 0.4.14 has a NULL pointer dereference in proces…7.5