CVE-2025-32699: Potential javascript injection attack enabled by Unicode normalization in Action API

Severity: low (CVSS 2.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-10 · updated 2026-06-17
Weakness: CWE-74

Description

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

Affected products

Wikimedia Foundation MediaWiki: before 1.39.12, 1.42.6, 1.43.1 — fixed in 1.42.6, 1.43.1, 1.39.12
Wikimedia Foundation Parsoid: before 0.16.5, 0.19.2, 0.20.2 — fixed in 0.19.2, 0.20.2, 0.16.5

How to fix

Upgrade to a fixed version: Wikimedia Foundation MediaWiki 1.42.6, 1.43.1, 1.39.12; Wikimedia Foundation Parsoid 0.19.2, 0.20.2, 0.16.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-32699 or the next vulnerability affects your stack