Css
Monthly
The MediaWiki CSS extension in versions 1.39, 1.43, and 1.44 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server. Public exploit code exists for this vulnerability, enabling attackers to access sensitive information outside the intended directory restrictions. A patch is available and should be applied immediately to affected installations.
Memory leak in CSS::Minifier::XS (Perl CPAN module by gtermars) before version 0.14 allows unauthenticated remote attackers to trigger unreleased memory by submitting CSS documents composed entirely of removable content - comments and whitespace. When the minify() function processes such input and the entire document is consumed by the minification pass, the underlying XS (C extension) layer fails to release the allocated memory, satisfying CWE-401. The Information Disclosure tag and C:L CVSS rating suggest leaked heap contents may expose sensitive in-process data, though the more immediate risk is incremental memory exhaustion in long-running web services. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) reflects minimal observed exploitation interest.
The MediaWiki CSS extension in versions 1.39, 1.43, and 1.44 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server. Public exploit code exists for this vulnerability, enabling attackers to access sensitive information outside the intended directory restrictions. A patch is available and should be applied immediately to affected installations.
Memory leak in CSS::Minifier::XS (Perl CPAN module by gtermars) before version 0.14 allows unauthenticated remote attackers to trigger unreleased memory by submitting CSS documents composed entirely of removable content - comments and whitespace. When the minify() function processes such input and the entire document is consumed by the minification pass, the underlying XS (C extension) layer fails to release the allocated memory, satisfying CWE-401. The Information Disclosure tag and C:L CVSS rating suggest leaked heap contents may expose sensitive in-process data, though the more immediate risk is incremental memory exhaustion in long-running web services. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) reflects minimal observed exploitation interest.