{"id":"CVE-2026-126564","kind":"vulnerability","aliases":["CVE-2026-126564"],"related":[],"title":"Semantic MediaWiki: stored script injection through property labels in Special:Browse","description":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal &nbsp; as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.","summary":"Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 fail to escape property label text when it is rendered on Special:Browse and the smwbrowse API. A user with page-edit rights can save a label containing an image onerror payload that runs in the browser of anyone who views it, including administrators.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["extension-not-installed","fixed-version"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's `composer.lock` / `extension.json`, and compare against `7.4.1`.\n- Review Semantic MediaWiki preferred property labels for HTML such as `<img onerror=...>` on the wiki.","fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later.","status":"open","published_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:29+00:00","updated_at":"2026-11-11T03:26:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:29Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later.","reach":"network","title":"Semantic MediaWiki: stored script injection through property labels in Special:Browse","impact":"medium","summary":"Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 fail to escape property label text when it is rendered on Special:Browse and the smwbrowse API. A user with page-edit rights can save a label containing an image onerror payload that runs in the browser of anyone who views it, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin browsers, session and data theft","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's `composer.lock` / `extension.json`, and compare against `7.4.1`.\n- Review Semantic MediaWiki preferred property labels for HTML such as `<img onerror=...>` on the wiki.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","extension-not-installed"],"who_is_affected":"Wikis running Semantic MediaWiki from 2.5.0 before 7.4.1 where users can edit pages and Special:Browse or the smwbrowse API is used. Wikis on a fixed version, or without the extension, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4667,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126564':14A,17A '-2026':13A,16A '2.5.0':30B,84C '7.4.1':36B,86C 'administr':81B,131C 'anyon':76B,129C 'api':53B,138C 'brows':11A,49B,134C 'browser':74B 'contain':65B,87C,121C 'cross':91C 'cross-sit':90C 'cve':12A,15A 'edit':59B,113C 'escap':39B 'execut':127C 'fail':37B 'getformattedsubject':97C 'host':22B 'imag':67B 'img':123C 'includ':35B,80B,130C 'inject':5A 'label':8A,41B,64B,101C,120C 'liter':105C 'markup':108C 'mediawiki':2A,18B,25B,27B,83C 'onerror':68B,124C 'packag':19B 'page':58B,112C 'page-edit':57B,111C 'payload':69B,125C 'prefer':118C 'properti':7A,40B,100C,119C 'render':46B,99C 'right':60B,114C 'run':71B 'save':62B 'script':4A,93C 'segment':102C 'self':21B 'self-host':20B 'semant':1A,24B,26B,82C 'semantic-mediawiki':23B 'set':116C 'site':92C 'smwbrows':52B,137C 'special':10A,48B,133C 'store':3A,89C 'text':42B 'unescap':107C 'user':55B,109C 'valueformatt':96C 'version':28B 'view':78B,132C 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 2.5.0 before 7.4.1 where users can edit pages and Special:Browse or the smwbrowse API is used. Wikis on a fixed version, or without the extension, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediawiki","medium","package","selfhosted","semanticmediawiki"],"campaign_type":null,"search_a":"'-126564':14A,17A '-2026':13A,16A 'brows':11A 'cve':12A,15A 'inject':5A 'label':8A 'mediawiki':2A 'properti':7A 'script':4A 'semant':1A 'special':10A 'store':3A","search_b":"'2.5.0':30B '7.4.1':36B 'administr':81B 'anyon':76B 'api':53B 'brows':49B 'browser':74B 'contain':65B 'edit':59B 'escap':39B 'fail':37B 'host':22B 'imag':67B 'includ':35B,80B 'label':41B,64B 'mediawiki':18B,25B,27B 'onerror':68B 'packag':19B 'page':58B 'page-edit':57B 'payload':69B 'properti':40B 'render':46B 'right':60B 'run':71B 'save':62B 'self':21B 'self-host':20B 'semant':24B,26B 'semantic-mediawiki':23B 'smwbrows':52B 'special':48B 'text':42B 'user':55B 'version':28B 'view':78B","search_c":"'2.5.0':84C '7.4.1':86C 'administr':131C 'anyon':129C 'api':138C 'brows':134C 'contain':87C,121C 'cross':91C 'cross-sit':90C 'edit':113C 'execut':127C 'getformattedsubject':97C 'img':123C 'includ':130C 'label':101C,120C 'liter':105C 'markup':108C 'mediawiki':83C 'onerror':124C 'page':112C 'page-edit':111C 'payload':125C 'prefer':118C 'properti':100C,119C 'render':99C 'right':114C 'script':93C 'segment':102C 'semant':82C 'set':116C 'site':92C 'smwbrows':137C 'special':133C 'store':89C 'unescap':107C 'user':109C 'valueformatt':96C 'view':132C 'vulner':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126564","severity":null,"published_at":"2026-11-11T03:16:50+00:00","modified_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122034,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c9bf9f25549bb2f5eab916339b267a1732002c4c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122036,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mc5x-2j7v-x8hp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122037,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-stored-xss-via-special-browse-factbox-title","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}