CVE-2026-126567: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the resulting script execution?
An attacker needs edit rights to store malicious markup in a Text property or subobject name. A victim must then visit an attacker-crafted Special:Ask link; administrators are specifically among the potential victims.
What configurations are affected?
The issue affects Semantic MediaWiki versions from 3.0.0 before 7.4.1 when using the ElasticStore backend. The vulnerable output is associated with Special:Ask debug output, specifically unescaped native_result and score_set fields.
What is the immediate mitigation if an upgrade is not possible?
The provided information does not identify a complete workaround. Reducing edit access for untrusted users and avoiding attacker-supplied Special:Ask links can reduce the opportunity to store payloads and trigger them.
How can I determine whether my deployment may be affected?
Check whether Semantic MediaWiki is version 3.0.0 through versions before 7.4.1 and whether ElasticStore is in use. Also review whether users with edit rights can create Text property values or subobject names containing markup and whether Special:Ask debug output is accessible.