Wikipedia user Suffusion of Yellow discovered a CSS injection vulnerability, which occurs when CSS comments /* ... */ are escaped with backslashes: \2f\2a ... \2a\2f. The bug is due to an error in the CSS escape sequence normalisation code which we introduced to fix bug 23687.

As with any CSS injection vulnerability, the impact is complete account compromise (XSS) for Internet Explorer users, and possible privacy loss due to arbitrary remote image embedding for users of other browsers.

Version: 1.16.x
Severity: normal