CVE-2026-116881: Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must be able to store a malicious value in a semantic property. The payload is rendered when another user opens the property-value autocomplete with an empty query.
Which users are exposed to the injected markup?
Users who open the affected property-value autocomplete with an empty query may receive the unescaped property value in the suggestion dropdown. Exploitation requires user interaction to open that autocomplete state.
Are installations affected by version?
Semantic MediaWiki versions from 3.0.0 before 7.3.1 are affected. Version 7.3.1 is outside the affected range stated in the advisory.
How can I identify potentially malicious stored values before patching?
Review semantic property values for markup or script-like content, particularly values that may be returned by the PValueLookup API and shown in autocomplete suggestions. The provided information does not identify a reliable automated indicator beyond the presence of such stored values.