CVE-2026-126564 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 fail to escape property label text when it is rendered on Special:Browse and the smwbrowse API. A user with page-edit rights can save a label containing an image onerror payload that runs in the browser of anyone who views it, including administrators.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Wikis running Semantic MediaWiki from 2.5.0 before 7.4.1 where users can edit pages and Special:Browse or the smwbrowse API is used. Wikis on a fixed version, or without the extension, are not affected.
Not affected if extension-not-installed, fixed-version
Who cares mediawiki, self-hosted, semantic-mediawiki
composer.lock / extension.json, and compare against 7.4.1.<img onerror=...> on the wiki.7.4.1 or later.Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.