Reflected Cross-Site Scripting in Semantic MediaWiki 2.4.0 from Semantic MediaWiki

CVE-2026-126563

What is CVE-2026-126563?

Semantic MediaWiki versions prior to 7.4.1 have been found to contain a reflected cross-site scripting vulnerability within the TimeValueFormatter component. This issue stems from the mishandling of free-format date captions emitted in HTML, allowing unauthenticated attackers to manipulate specially crafted Special:Ask URLs. By embedding HTML markup in a date format, attackers can execute arbitrary scripts in the browsers of users with active sessions, leading to potential data compromise and session hijacking.

References