CVE-2026-126563 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki 2.4.0 before 7.4.1 emits free-format date captions as HTML without escaping them. An attacker can craft a Special:Ask URL with HTML in a date printout format so that script runs in a logged-in victim's browser session.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running a MediaWiki wiki with the Semantic MediaWiki extension at a version from 2.4.0 up to but not including 7.4.1. The exposure comes through Special:Ask date printouts, so wikis that restrict or do not use Special:Ask are less exposed. Users must be logged in and visit a crafted link for the script to run in their session.
Not affected if version-7.4.1-or-later
Who cares mediawiki, self-hosted, semantic-mediawiki
2.4.0 and 7.4.1.7.4.1 or later.Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.