Live › vulnerability › CVE-2026-116874
Go to dashboardSemanticMediaWiki versions from 3.1.0 before 7.3.1 do not escape the default parameter in JsonResultPrinter, so a crafted Special:Ask link can inject JavaScript. A lured user who opens that link runs the script in the wiki's origin, where it can steal sessions or CSRF tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running SemanticMediaWiki from 3.1.0 up to but not including 7.3.1 are exposed, because the flaw is reachable by any anonymous visitor who follows a crafted Special:Ask link. Wikis on versions outside that range, or without the extension installed, can skip it.
No product ranges from the sources yet.
composer.lock file for mediawiki/semantic-media-wiki7.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-116874")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.