CVE-2025-46346: YesWiki Comments Feature Vulnerability Leading to Stored XSS
Summary
CVE-2025-46346: YesWiki Stored XSS Vulnerability in Comments. Affects yeswiki/yeswiki versions < 4.5.4. Fixed in 4.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It features a user-friendly interface for editing and commenting on pages. However, a critical vulnerability has been identified in its comments feature, which fails to adequately sanitize user inputs, making it susceptible to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the YesWiki comments feature, allowing attackers to inject malicious JavaScript payloads. This occurs due to insufficient sanitization of user inputs, particularly with payloads that use JavaScript block comments to bypass restrictions. As a result, any user viewing the affected comment can have arbitrary JavaScript executed in their browser, potentially leading to further exploits such as remote code execution (RCE) when combined with other vulnerabilities.
How To Fix
Minimum fixed version
4.5.4
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the comments feature in your YesWiki installation until the package is updated. This can be done by modifying the configuration settings to prevent users from submitting comments.
Conclusion
The stored XSS vulnerability in YesWiki's comments feature poses significant risks to users. It is crucial to update to version 4.5.4 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in your software, ensuring ongoing security.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
Stored XSS vulnerabilities allow attackers to inject malicious scripts that are stored on the server and executed in the browsers of users who access the affected content.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your composer.lock file.
An attacker can execute arbitrary JavaScript in the victim's browser, which can lead to data theft, session hijacking, or further exploitation of the application.
While the best solution is to update to the patched version, you can temporarily disable the comments feature to prevent exploitation until an update is applied.
If immediate updates are not possible, ensure that your application is monitored for any suspicious activity and consider implementing additional security measures such as input validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
