Live › vulnerability › CVE-2026-116881
Go to dashboardSemantic MediaWiki from 3.0.0 before 7.3.1 renders stored semantic property values unescaped in the property-value autocomplete dropdown. When another user opens that autocomplete with an empty query, injected markup or script can run in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 3.0.0 and 7.3.1 are exposed when users can store semantic property values, which lets an attacker plant a payload that other editors trigger by opening the property-value autocomplete. Wikis where only trusted editors can write semantic annotations carry less risk. Sites on versions 7.3.1 or later are not affected.
No product ranges from the sources yet.
composer.lock entry for mediawiki/semantic-media-wiki; versions from 3.0.0 up to but not including 7.3.1 are affected.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.
This page as .md · .json · in your agent: get_signal("CVE-2026-116881")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.