{"id":"CVE-2026-126563","kind":"vulnerability","aliases":["CVE-2026-126563"],"related":[],"title":"Semantic MediaWiki: crafted Special:Ask URL runs script in victim's browser","description":"Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.","summary":"Semantic MediaWiki 2.4.0 before 7.4.1 emits free-format date captions as HTML without escaping them. An attacker can craft a Special:Ask URL with HTML in a date printout format so that script runs in a logged-in victim's browser session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["version-7.4.1-or-later"],"how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or the extension's composer.json, and see whether it is between `2.4.0` and `7.4.1`.","fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later.","status":"open","published_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:27+00:00","updated_at":"2026-11-11T03:26:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later.","reach":"internet","title":"Semantic MediaWiki: crafted Special:Ask URL runs script in victim's browser","impact":"medium","summary":"Semantic MediaWiki 2.4.0 before 7.4.1 emits free-format date captions as HTML without escaping them. An attacker can craft a Special:Ask URL with HTML in a date printout format so that script runs in a logged-in victim's browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"script runs in a logged-in user's browser session","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or the extension's composer.json, and see whether it is between `2.4.0` and `7.4.1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-7.4.1-or-later"],"who_is_affected":"Sites running a MediaWiki wiki with the Semantic MediaWiki extension at a version from 2.4.0 up to but not including 7.4.1. The exposure comes through Special:Ask date printouts, so wikis that restrict or do not use Special:Ask are less exposed. Users must be logged in and visit a crafted link for the script to run in their session.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4673,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126563':15A,18A '-2026':14A,17A '2.4.0':29B,73C '7.4.1':31B,75C 'ask':5A,49B,104C 'attack':44B,99C 'browser':12A,69B,125C 'caption':37B,93C 'contain':76C 'craft':3A,46B,101C 'cross':80C 'cross-sit':79C 'cve':13A,16A 'date':36B,55B,92C,111C 'emit':32B,88C 'escap':41B,97C 'execut':116C 'f':114C 'format':35B,57B,91C,113C 'free':34B,90C 'free-format':33B,89C 'getcaptionfromfreeformat':86C 'host':23B 'html':39B,52B,95C,107C 'log':65B,121C 'logged-in':64B,120C 'markup':108C 'mediawiki':2A,19B,26B,28B,72C 'packag':20B 'printout':56B,112C 'reflect':78C 'run':7A,61B 'script':8A,60B,82C,117C 'self':22B 'self-host':21B 'semant':1A,25B,27B,71C 'semantic-mediawiki':24B 'session':70B,126C 'site':81C 'special':4A,48B,103C 'timevalueformatt':85C 'unauthent':98C 'url':6A,50B,105C 'victim':10A,67B,123C 'vulner':83C 'without':40B,96C","nicknames":[],"mitigations":[],"who_affected":"Sites running a MediaWiki wiki with the Semantic MediaWiki extension at a version from 2.4.0 up to but not including 7.4.1. The exposure comes through Special:Ask date printouts, so wikis that restrict or do not use Special:Ask are less exposed. Users must be logged in and visit a crafted link for the script to run in their session.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediawiki","medium","package","selfhosted","semanticmediawiki"],"campaign_type":null,"search_a":"'-126563':15A,18A '-2026':14A,17A 'ask':5A 'browser':12A 'craft':3A 'cve':13A,16A 'mediawiki':2A 'run':7A 'script':8A 'semant':1A 'special':4A 'url':6A 'victim':10A","search_b":"'2.4.0':29B '7.4.1':31B 'ask':49B 'attack':44B 'browser':69B 'caption':37B 'craft':46B 'date':36B,55B 'emit':32B 'escap':41B 'format':35B,57B 'free':34B 'free-format':33B 'host':23B 'html':39B,52B 'log':65B 'logged-in':64B 'mediawiki':19B,26B,28B 'packag':20B 'printout':56B 'run':61B 'script':60B 'self':22B 'self-host':21B 'semant':25B,27B 'semantic-mediawiki':24B 'session':70B 'special':48B 'url':50B 'victim':67B 'without':40B","search_c":"'2.4.0':73C '7.4.1':75C 'ask':104C 'attack':99C 'browser':125C 'caption':93C 'contain':76C 'craft':101C 'cross':80C 'cross-sit':79C 'date':92C,111C 'emit':88C 'escap':97C 'execut':116C 'f':114C 'format':91C,113C 'free':90C 'free-format':89C 'getcaptionfromfreeformat':86C 'html':95C,107C 'log':121C 'logged-in':120C 'markup':108C 'mediawiki':72C 'printout':112C 'reflect':78C 'script':82C,117C 'semant':71C 'session':126C 'site':81C 'special':103C 'timevalueformatt':85C 'unauthent':98C 'url':105C 'victim':123C 'vulner':83C 'without':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126563","severity":null,"published_at":"2026-11-11T03:16:50+00:00","modified_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122030,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/01cb81a6da7af743d2a5eb334db10e52b7318c56","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122032,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122033,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.4.0-before-7.4.1-reflected-xss-via-special-ask-date-format","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}