{"id":"CVE-2026-126567","kind":"vulnerability","aliases":["CVE-2026-126567"],"related":[],"title":"Semantic MediaWiki: stored script injection through Special:Ask results","description":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.","summary":"Semantic MediaWiki 3.0.0 before 7.4.1 does not escape output on Special:Ask when the ElasticStore backend is used, so stored markup runs as script. An attacker with edit rights can store the payload and get an administrator to open a crafted Special:Ask link, running script in the victim's session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elasticstore","mediawiki","package","semantic-mediawiki"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or in `composer.lock` for `mediawiki/semantic-media-wiki`\n- Check whether `$smwgElasticsearchEndpoints` or the ElasticStore backend is configured in `LocalSettings.php`","fix":"- Semantic MediaWiki: `7.4.1` (fixed version per the description: versions before 7.4.1 are affected)","status":"open","published_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:27+00:00","updated_at":"2026-11-11T03:26:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T03:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki: `7.4.1` (fixed version per the description: versions before 7.4.1 are affected)","reach":"internet","title":"Semantic MediaWiki: stored script injection through Special:Ask results","impact":"medium","summary":"Semantic MediaWiki 3.0.0 before 7.4.1 does not escape output on Special:Ask when the ElasticStore backend is used, so stored markup runs as script. An attacker with edit rights can store the payload and get an administrator to open a crafted Special:Ask link, running script in the victim's session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["semantic-mediawiki","mediawiki","elasticstore"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in an administrator's session on the wiki","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or in `composer.lock` for `mediawiki/semantic-media-wiki`\n- Check whether `$smwgElasticsearchEndpoints` or the ElasticStore backend is configured in `LocalSettings.php`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","patched-version"],"who_is_affected":"Wikis that run Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 and use the ElasticStore backend are exposed. Users with edit rights can plant the payload, so wikis with open editing or many editors carry more risk. Wikis on other storage backends or on a patched version can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4669,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126567':12A,15A '-2026':11A,14A '3.0.0':24B,75C '7.4.1':26B,77C 'administr':58B,124C 'allow':93C 'ask':8A,33B,64B,88C,129C 'attack':47B,109C 'backend':37B,92C 'contain':78C 'craft':62B,127C 'cross':82C 'cross-sit':81C 'cve':10A,13A 'edit':49B,96C 'elasticstor':16B,36B,91C 'escap':29B 'execut':132C 'get':56B 'includ':123C 'inject':5A,99C 'link':65B,130C 'lure':121C 'markup':42B,112C 'mediawiki':2A,17B,21B,23B,74C 'name':119C 'nativ':103C 'open':60B 'output':30B,108C 'packag':18B 'payload':54B 'properti':116C 'result':9A,104C 'right':50B,97C 'run':43B,66B 'score':106C 'script':4A,45B,67B,84C,100C,133C 'semant':1A,20B,22B,73C 'semantic-mediawiki':19B 'session':72B,136C 'set':107C 'site':83C 'special':7A,32B,63B,87C,128C 'store':3A,41B,52B,80C,111C 'subobject':118C 'text':115C 'unescap':102C 'use':39B 'user':94C 'victim':70B,122C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Wikis that run Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 and use the ElasticStore backend are exposed. Users with edit rights can plant the payload, so wikis with open editing or many editors carry more risk. Wikis on other storage backends or on a patched version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elasticstore","mediawiki","medium","package","semanticmediawiki"],"campaign_type":null,"search_a":"'-126567':12A,15A '-2026':11A,14A 'ask':8A 'cve':10A,13A 'inject':5A 'mediawiki':2A 'result':9A 'script':4A 'semant':1A 'special':7A 'store':3A","search_b":"'3.0.0':24B '7.4.1':26B 'administr':58B 'ask':33B,64B 'attack':47B 'backend':37B 'craft':62B 'edit':49B 'elasticstor':16B,36B 'escap':29B 'get':56B 'link':65B 'markup':42B 'mediawiki':17B,21B,23B 'open':60B 'output':30B 'packag':18B 'payload':54B 'right':50B 'run':43B,66B 'script':45B,67B 'semant':20B,22B 'semantic-mediawiki':19B 'session':72B 'special':32B,63B 'store':41B,52B 'use':39B 'victim':70B","search_c":"'3.0.0':75C '7.4.1':77C 'administr':124C 'allow':93C 'ask':88C,129C 'attack':109C 'backend':92C 'contain':78C 'craft':127C 'cross':82C 'cross-sit':81C 'edit':96C 'elasticstor':91C 'execut':132C 'includ':123C 'inject':99C 'link':130C 'lure':121C 'markup':112C 'mediawiki':74C 'name':119C 'nativ':103C 'output':108C 'properti':116C 'result':104C 'right':97C 'score':106C 'script':84C,100C,133C 'semant':73C 'session':136C 'set':107C 'site':83C 'special':87C,128C 'store':80C,111C 'subobject':118C 'text':115C 'unescap':102C 'user':94C 'victim':122C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126567","severity":null,"published_at":"2026-11-11T03:16:51+00:00","modified_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122049,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/fca9922835f4353e67a71cfef4d527d46e7c3ad3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122051,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7j96-w9cc-r7rq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122052,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-special-ask-debug-output","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}