CVE-2021-30458

An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS...

CVE-2025-32699

CVE-2025-32699 affects Wikimedia Foundation MediaWiki and Parsoid. Affected: MediaWiki before 1.39.12, 1.42.6, 1.43.1; Parsoid before 0.16.5, 0.19.2, 0.20.2. Root cause: Unicode normalization enabling a potential JavaScript injection via Action API (i.e., abuse of the API to inject JS). Impacts: ...

CVE-2025-32699 Potential javascript injection attack enabled by Unicode normalization in Action API

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2...