What is the CVSS score of CVE-2025-62697?

CVE-2025-62697 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-62697?

Within 24 hours, identify all MediaWiki instances running the LanguageSelector extension in versions prior to 1.39 and consider disabling the extension if it is not business-critical; if it must remain enabled, deploy web application firewall (WAF) rules to detect and block code injection attempts targeting the extension, and enable detailed logging for the extension. Within 7 days, monitor the vendor's advisory page for a patch release and, if a patch becomes available, test and apply it immediately; if no patch is released, evaluate upgrading to MediaWiki 1.39 or later where the extension may be bundled or compatible, and restrict access to the extension's functionality to trusted users only. Within 30 days, if a patch remains unavailable, conduct a risk assessment to determine whether the extension can be permanently removed or replaced, and implement additional monitoring and alerting for anomalous code execution or unauthorized changes on affected MediaWiki instances. Note: No vendor-released patch identified at time of analysis.

MediaWiki LanguageSelector CVE-2025-62697

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-20 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Mediawiki Code Injection

8.8

CVSS 4.0 · Vendor: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach MediaWiki with LanguageSelector
Delivery

Send crafted injection payload
Exploit

Downstream component fails neutralization
Execution

Code injection executes
Impact

Service availability degraded

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions	Requires the MediaWiki LanguageSelector extension to be installed and enabled at a version from master before 1.39; MediaWiki core alone without this extension is not affected. The CVSS vector indicates no authentication and no user interaction are needed (PR:N/UI:N) against such an instance, so the primary limiting factor is deployment of this specific, non-core extension rather than any privilege or configuration barrier. The exact triggering input (which parameter or language-selection feature carries the injectable element) is not specified in the available data, so defenders should confirm the entry point with the Phabricator T399724 ticket.
Impact	The CVSS 4.0 base score of 8.8 (High) is driven by a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) combined with high availability impact (VA:H) and low confidentiality/integrity impact (VC:L/VI:L), consistent with a code-injection flaw (CWE-74) in the MediaWiki LanguageSelector extension. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation is 'no public exploit identified at time of analysis.' This tempers the otherwise alarming vector: the theoretical attack surface is broad and pre-authentication, but there is no evidence of active exploitation or weaponization. A key caveat is that the vector asserts PR:N/UI:N (no privileges, no interaction) while the description only states 'allows Code Injection' without naming the entry point, so the real-world attack path is inferred from the vector rather than confirmed by vendor detail. The practical priority is moderate: patch promptly where the LanguageSelector extension is installed, but the limited deployment footprint of this specific extension (versus MediaWiki core) likely keeps real-world risk below what the raw 8.8 suggests.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted request to a MediaWiki instance running a vulnerable (pre-1.39) LanguageSelector extension, injecting special elements that are improperly neutralized by a downstream component, resulting in code injection. Per the CVSS vector this needs no authentication or user interaction (PR:N/UI:N) and is low-complexity (AC:L), with the dominant effect being availability disruption (VA:H). No public proof-of-concept exploit is referenced in the available data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Code injection in the MediaWiki LanguageSelector extension (versions from master before 1.39) allows remote, unauthenticated attackers to execute arbitrary code on affected MediaWiki instances, resulting in high availability impact and limited confidentiality/integrity compromise. The flaw is an improper neutralization of special elements in output (CWE-74) that are later used by a downstream component. No public exploit code is identified at time of analysis, and MediaWiki core without this extension is unaffected.

RemediationAI

Apply the upstream fix from the Wikimedia Gerrit change I338288e756de4e58a3f1f02a9c205b37f4927935, or upgrade the LanguageSelector extension to version 1.39 or later. This is an upstream fix; a released patched version is not independently confirmed, but the commit addresses the issue. As a compensating control, if the extension is not required, disable or uninstall it to remove the attack surface; side effect is loss of language selection functionality for users. Review the Phabricator ticket T399724 for any additional mitigation details. No vendor patch version is specified beyond the 1.39 target.

Affected ProductsAI

The vulnerability affects the MediaWiki LanguageSelector extension for the MediaWiki platform, specifically versions from the master branch before 1.39. MediaWiki core installations that do not have this extension installed are not affected. No specific CPE strings are provided in the available data. The vendor advisory and fix are documented in the Wikimedia Gerrit change I338288e756de4e58a3f1f02a9c205b37f4927935 and the Phabricator ticket T399724 (https://phabricator.wikimedia.org/T399724).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability class CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) indicates that the LanguageSelector extension fails to properly sanitize or escape user-supplied input before it is passed to another component (e.g., a shell, a template engine, or an API). This can lead to code injection, where an attacker's input is interpreted as code by that downstream component. The affected component is the LanguageSelector extension for MediaWiki, specifically versions from master before 1.39. The exact parameter or feature that carries the injectable element is not detailed in the available data; the Phabricator ticket T399724 and Gerrit change I338288e756de4e58a3f1f02a9c205b37f4927935 provide the upstream fix and likely the technical specifics. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H) and independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) both confirm a fully remote, unauthenticated attack vector with no user interaction, primarily affecting availability.

Know when Mediawiki gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (c4f26cc8-17ff-4c99-b5e2-38fc1793eacc) PRIMARY 8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L

vuln.today AI 8.6 HIGH

Remote, low-complexity, unauthenticated with no interaction per the extension's network-facing injection; availability impact is high while confidentiality and integrity are low, matching the 4.0 VC:L/VI:L/VA:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (c4f26cc8-17ff-4c99-b5e2-38fc1793eacc).

CVSS VectorVendor: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

High

Subsequent system: Confidentiality

Low

Subsequent system: Integrity

Low

Subsequent system: Availability

Low

DescriptionCVE.org

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.

Executive ViewAI

Why It Matters

The MediaWiki LanguageSelector extension (versions before 1.39) contains a high-severity code injection vulnerability (CVE-2025-62697) that could allow remote attackers to execute arbitrary code on affected MediaWiki instances. Organizations using this extension for multilingual wikis face potential service disruption and data compromise, though MediaWiki core without the extension is unaffected. Leadership should prioritize mitigation because no vendor patch is currently available and the vulnerability poses a significant risk to wiki availability and integrity.

Business Impact: High

Compensating Controls

No vendor patch available. Interim mitigations include disabling the LanguageSelector extension if not required, restricting access to the extension to trusted users, deploying web application firewall rules to block code injection patterns, and monitoring logs for suspicious activity.

Threat Intelligence Overview

EPSS Score

0.3%

Top 74% exploitable

Prevalence

Low

niche MediaWiki extension, not core; limited installed base

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.