CVE-2022-28202: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only
• Mediawiki Mediawiki: before 1.35.6 (fixed in 1.35.6); from 1.36.0, before 1.36.4 (fixed in 1.36.4); from 1.37.0, before 1.37.2 (fixed in 1.37.2)

Published 2022-03-30. Last modified 2026-06-17.