CVE-2026-116889: SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property

Q: Who can introduce the malicious content?

An attacker needs page-edit rights. They can place HTML markup in a valid JSON value used by a Code-typed property.

Q: Which users are at risk of script execution?

Users who view the affected property through Special:Browse can have JavaScript executed in their browser session. The issue is stored, so the malicious value can affect later viewers after it has been saved.

Q: Which releases should be remediated?

SemanticMediaWiki versions from 2.5.0 through versions before 7.3.1 are affected. Update to 7.3.1 or later.

Published Oct 27, 2026

Updated

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=2.5.0<7.3.1

Event History

Oct 27, 2026

CVE Published

via MITRE·10:23 AM

Data Sourced

via MITRE·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can introduce the malicious content?

An attacker needs page-edit rights. They can place HTML markup in a valid JSON value used by a Code-typed property.

Which users are at risk of script execution?

Users who view the affected property through Special:Browse can have JavaScript executed in their browser session. The issue is stored, so the malicious value can affect later viewers after it has been saved.

Which releases should be remediated?