Cross-Site Scripting Risk in Semantic MediaWiki by Semantic MediaWiki

CVE-2026-116881

What is CVE-2026-116881?

Semantic MediaWiki versions prior to 7.3.1 are subject to a cross-site scripting vulnerability that enables attackers to inject harmful markup through stored semantic property values. The vulnerability is triggered when users access the property-value autocomplete feature with an empty query. In this scenario, the jQuery-based autocomplete script may inadvertently concatenate unescaped inputs into HTML, thereby modifying the dropdown content and potentially executing malicious scripts in the user’s browser environment. This flaw emphasizes the importance of input validation and output encoding to prevent unauthorized script execution.

References