Live › vulnerability › CVE-2026-116889
Go to dashboardSemanticMediaWiki versions from 2.5.0 before 7.3.1 fail to escape HTML in Code-typed property values when rendered on Special:Browse. A user with page-edit rights can store a JSON value containing markup that runs JavaScript in the sessions of anyone who views that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running SemanticMediaWiki from 2.5.0 up to but not including 7.3.1 that let users edit pages. Exposure requires a Code-typed property to be used, and a viewer of the injected page is needed to trigger the script. Wikis on versions 7.3.1 or later, or without SemanticMediaWiki, are not affected.
No product ranges from the sources yet.
composer show mediawiki/semantic-media-wiki7.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.