CVE-2025-53369
Last modified
CVE-2025-53369 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-53369?
How severe is CVE-2025-53369?
How do I fix CVE-2025-53369?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53363dpanel is an open source server management panel written in …4.8
- CVE-2025-53364Parse Server is an open source backend that can be deployed …5.3
- CVE-2025-53365The MCP Python SDK, called `mcp` on PyPI, is a Python implem…8.7
- CVE-2025-53366The MCP Python SDK, called `mcp` on PyPI, is a Python implem…8.7
- CVE-2025-53367DjVuLibre is a GPL implementation of DjVu, a web-centric for…8.4
- CVE-2025-53368Citizen is a MediaWiki skin that makes extensions part of th…5.4
- CVE-2025-5337The Slider, Gallery, and Carousel by MetaSlider plugin for W…5.4
- CVE-2025-53370Citizen is a MediaWiki skin that makes extensions part of th…5.4
- CVE-2025-53371DiscordNotifications is an extension for MediaWiki that send…9.1
- CVE-2025-53372node-code-sandbox-mcp is a Node.js–based Model Context Proto…7.5
- CVE-2025-53373Natours is a Tour Booking API. The attacker can easily take …8.9
- CVE-2025-53374Dokploy is a self-hostable Platform as a Service (PaaS) that…4.3
Are you affected by CVE-2025-53369?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST