title:     Non-jqueryMsg version of mw.message(?).parse() doesn't escape HTML
link:      https://phabricator.wikimedia.org/T115888
reference: composer://mediawiki/core
cve:       CVE-2020-25828
branches:
    1.31.x:
        time: 2020-09-24 01:26:41
        versions: ['>=1.31.0', '<1.31.9']
    1.34.x:
        time: 2020-09-24 01:38:27
        versions: ['>=1.34.0', '<1.34.3']
    1.35.x:
        time: 2020-09-24 17:14:47
        versions: ['>=1.34.99', '<1.35.0']
 
  |