wikimedia/parsoid
Parsoid, a bidirectional parser between wikitext and HTML5
84%
Total Score
100
86
83
Health Score Breakdown
The detector reports that the package borrows the identity of wikimedia/composer-merge-plugin, but artifact overlap is 0 and the README does not identify it as that package; the warning is therefore limited rather than evidence of a copy.
The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.
This release is a prerelease and 90% of recent releases are prereleases, so consumers should expect a less settled compatibility surface.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10380 wikimedia/parsoid is vulnerable to Cross-site Scripting (XSS) in versions 0.11.0 - 0.16.4, 0.17.0 - 0.19.1 and 0.20.0 - 0.20.1. | 0.11.0 - 0.16.40.17.0 - 0.19.10.20.0 - 0.20.1 | Low |
CVE-2021-30458 wikimedia/parsoid is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.12 - 0.12.2 and 0.0.0 - 0.11.1. | 0.0.0 - 0.11.10.12 - 0.12.2 | Medium |
Package versions
Maintainers
 Wikimedia Content Transform Team and the broader MediaWiki community |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1.1.4 || ^3.0.0 | — | — |
psr/container Version ~1.1.2 || ~2.0.2 | — | — |
composer/semver Version ^3.4.0 | — | — |
wikimedia/assert Version ^0.5.1 | — | — |
wikimedia/wikipeg Version ^5.0.1 || ^6.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 7 months ago
- Created
- 6 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.