Live › vulnerability › CVE-2026-116875
Go to dashboardSemantic MediaWiki's Special:Ask page echoes separator parameters (sep, propsep, valuesep, delim, separator) into list, category, DSV and CSV results without HTML escaping. A crafted link can make a victim's browser run JavaScript on the wiki's origin, which can steal sessions or CSRF tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 3.0.0 and 7.3.1 that expose Special:Ask with list, category, DSV or CSV result printers are exposed. Victims must open a crafted link, so the attack depends on user interaction, though no login is needed to send the link. Wikis not running Semantic MediaWiki in that version range can skip it.
No product ranges from the sources yet.
composer.lock / extensions/SemanticMediaWiki checkout; affected range is 3.0.0 up to but not including 7.3.1.LocalSettings.php with wfLoadExtension( 'SemanticMediaWiki' );.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-116875")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.