How to fix CVE-2025-53369?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Is Short Description affected by CVE-2025-53369?

Organizations using Short Description face significant risk from CVE-2025-53369, a cross-site scripting vulnerability rated CVSS 8.6. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users.

Short Description CVE-2025-53369

EUVD-2025-19899 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-03 [email protected]

GHSA-p85q-mww9-gwqf

XSS

8.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 16, 2026 - 02:12 vuln.today

EUVD ID Assigned

Mar 16, 2026 - 02:12 euvd

EUVD-2025-19899

CVE Published

Jul 03, 2025 - 20:15 nvd

HIGH 8.6

DescriptionNVD

Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

CVE-2025-53369 vulnerability details – vuln.today

Back