| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | < 1.35.1 | 1.35.1 |
In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free