CVE-2023-45359

What it actually does

Unescaped line parameter allows arbitrary markup injection into the vector-toc-toggle-button-label element in the Vector skin, resulting in reflected cross-site scripting.

Why it matters to the business

Attackers can run unauthorized scripts in users' browsers on affected wikis, risking session hijacking, data theft, or unauthorized actions; low exploit prevalence and no ransomware use reduce immediate urgency but still require prompt patching of exposed installations.

How an attack unfolds

An attacker supplies a crafted URL containing markup in the line parameter; the Vector skin renders the value directly into the table-of-contents toggle label without escaping, causing the browser to execute the injected code when the page loads.

How to fix it

Upgrade to MediaWiki 1.39.5 or 1.40.1 or later; for the listed Alpine packages apply the 1.0.11-r1 fixes where applicable.

How to confirm the fix worked

Confirm the vector-toc-toggle-button-label output is properly escaped by testing the line parameter with HTML entities; verify package versions match the fixed releases.

Typical attack path

1. Identify a MediaWiki instance using the Vector skin
2. Craft a URL with malicious markup in the line parameter
3. Deliver the link to a target user
4. Script executes in the victim's browser context

How to detect it

Search web access logs and application logs for requests containing the line parameter with HTML or script tags; inspect rendered page source for unescaped content in the table-of-contents toggle.

What your security team should do

• Apply the listed fixed versions immediately on any exposed MediaWiki deployments
• Review web server logs for suspicious line parameter values
• Monitor EPSS trend for any future increase in exploitation likelihood