CVE-2025-59332: dolfinus 3DAlloy · Cross-site Scripting
Affects dolfinus 3DAlloySource CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 15 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-59332, European organizations should take immediate and specific actions beyond generic advice: 1) Audit all MediaWiki instances to identify deployments of the 3DAlloy extension and determine the version in use. 2) Disable or restrict the use of the <3d> parser tag and {{#3d}} parser function until a secure patch or update is available. This can be done by modifying MediaWiki configuration to disable the extension or restrict parser function usage to trusted users only. 3) Implement strict input validation and sanitization on any user-supplied attributes passed to the 3DAlloy extension, ideally by applying a whitelist of allowed attributes and escaping any special characters before rendering. 4) Monitor web server and application logs for unusual or suspicious requests targeting the 3DAlloy functionality, which could indicate attempted exploitation. 5) Educate wiki administrators and users about the risks of injecting untrusted content and encourage reporting of suspicious behavior. 6) Follow the vendor’s channels closely for the release of patches or updated versions that address this vulnerability and apply them promptly. 7) As a longer-term measure, consider isolating MediaWiki instances or restricting access to trusted networks to reduce exposure. 8) Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts in browsers accessing the wiki pages, mitigating the impact of potential XSS attacks.
Description
3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.