CVE-2026-126560 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki's DataTables integration renders author-written smw-datatable cell attributes without sanitising them. A user with page-edit rights can store markup that runs script in the browser of anyone who views the page, including administrators.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 that use the DataTables integration (smw-datatable tables). Exposure needs a user with page-edit rights to write the payload, and the script then runs for any viewer, so wikis open to many editors carry more risk. Wikis that do not use smw-datatable tables are not exposed through this path.
Not affected if no-smw-datatable-tables, versions-7.4.1-or-later
Who cares mediawiki, self-hosted, semantic-mediawiki
Special:Version page or composer.json/LocalSettings.php setup.smw-datatable class, with data-search or data-filter attributes.7.4.1 or later (the fix version for this CVE per the NVD range: before 7.4.1).Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.