GHSA-7j96-w9cc-r7rq: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output

Published Nov 11, 2026

Updated

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.

Event History

Nov 11, 2026

CVE Published

via OSV·02:36 AM

Data Sourced

via OSV·02:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs edit rights in the affected Semantic MediaWiki instance. They can place malicious markup in a Text property or subobject name and use a crafted Special:Ask link to trigger execution when another user visits it.

Which users are at risk from a malicious query link?

Any user who follows the crafted Special:Ask link may execute the stored script in their authenticated browser session, including administrators. The impact is therefore greater where users with elevated privileges can be persuaded to open attacker-supplied query links.

What configuration is required for exposure?

The vulnerable behavior is associated with Special:Ask debug output when Semantic MediaWiki uses the ElasticStore backend. The provided information does not establish that installations using other backends are affected.

What should be prioritized if immediate upgrading is not possible?

Restrict edit rights to trusted users and prevent untrusted users from adding markup to Text properties or subobject names. Treat unsolicited or user-provided Special:Ask links as untrusted, particularly for administrator accounts.

GHSA-7j96-w9cc-r7rq: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output

Event History

Frequently Asked Questions

Who can exploit this issue?

Which users are at risk from a malicious query link?

What configuration is required for exposure?

What should be prioritized if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which users are at risk from a malicious query link?

What configuration is required for exposure?

What should be prioritized if immediate upgrading is not possible?