DOM rendering pipeline analysis demonstrating cross-site scripting attack vectors in MediaWiki parser

Vulnerabilities

Serious XSS affecting Wikipedia

XSS vulnerability in thumb.php in Wikipedia Mediawiki

John W8MEJ Menerick September 8, 2017 1-minute read Updated August 18, 2026

Key takeaways

Complex wikitext parsing engines create intricate sanitization bypass surfaces.
High-trust collaborative encyclopedias require ruthless DOM-purifying output filters.
XSS on high-reputation knowledge repositories turns legitimate information into malware vectors.

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.

[ Above was an interesting XSS affecting all of Wikipedia and MediaWiki software. It was found during manual code review. Not much to be said about it other than failure to validate and / or sanitize input. Great response by the MediaWiki development and Wikipedia Security team!

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab