CVE-2026-126567 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki 3.0.0 before 7.4.1 does not escape output on Special:Ask when the ElasticStore backend is used, so stored markup runs as script. An attacker with edit rights can store the payload and get an administrator to open a crafted Special:Ask link, running script in the victim's session.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Wikis that run Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 and use the ElasticStore backend are exposed. Users with edit rights can plant the payload, so wikis with open editing or many editors carry more risk. Wikis on other storage backends or on a patched version can skip it.
Not affected if default-config, patched-version
Who cares elasticstore, mediawiki, semantic-mediawiki
composer.lock for mediawiki/semantic-media-wiki$smwgElasticsearchEndpoints or the ElasticStore backend is configured in LocalSettings.php7.4.1 (fixed version per the description: versions before 7.4.1 are affected)Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.