CVE-2026-116874 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within SemanticMediaWiki versions ranging from 3.1.0 up to but not including 7.3.1 represents a significant security flaw classified as a reflected cross-site scripting issue. This defect resides specifically in the JsonResultPrinter component, which is responsible for handling and rendering query results. The core technical failure involves an improper neutralization of special elements within user-supplied input before it is output to a web browser. Specifically, the default parameter associated with this printer fails to undergo adequate sanitization or encoding processes prior to being embedded into the HTML response structure. This lack of proper validation allows malicious actors to inject executable script code directly into the application's output stream without triggering standard security filters that might otherwise block such payloads.
From an operational perspective, this vulnerability enables unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user’s browser session on the wiki origin. The exploitation mechanism typically involves crafting a deceptive link pointing to Special:Ask with specific parameters designed to trigger the vulnerable code path while ensuring zero query results are returned. By setting request_type=special_page and embedding malicious script payloads within the unescaped default parameter, an attacker can lure unsuspecting users into clicking the crafted URL. Once accessed by a victim who is logged in or has active session cookies associated with the wiki domain, the injected JavaScript executes immediately due to the browser's same-origin policy treating the payload as trusted content from that origin.
The impact of this vulnerability extends beyond mere script execution and encompasses severe risks related to data theft and unauthorized actions. Attackers can leverage the executed scripts to steal sensitive information such as session cookies, which could lead to account takeover if those sessions are not properly secured or rotated. Furthermore, because the attack occurs within the trusted origin context, it facilitates Cross-Site Request Forgery attacks where malicious commands can be performed on behalf of the authenticated user without their knowledge or consent. This capability allows adversaries to manipulate wiki content, alter settings, or perform other privileged actions depending on the victim's permissions level, thereby compromising the integrity and confidentiality of the entire platform.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the attack where the payload is reflected back to the user without being stored in a database or persistent storage places it firmly within the realm of non-persistent XSS attacks. Additionally, from an adversary tactics perspective, this exploitation method corresponds to techniques found in the MITRE ATT&CK framework under T1059 Command and Scripting Interpretation for executing JavaScript payloads and potentially T1534 Internal Spearphishing if used to target specific users within an organization through deceptive links.
To mitigate this vulnerability, administrators must upgrade SemanticMediaWiki to version 7.3.1 or later where the issue has been resolved by implementing proper input encoding and output escaping mechanisms in the JsonResultPrinter component. Until such upgrades are applied, temporary mitigations may include restricting access to Special:Ask endpoints through web application firewalls that can detect and block suspicious query parameters containing script-like patterns. Additionally enforcing strict Content Security Policy headers can help limit the execution of inline scripts even if they are injected, thereby reducing the blast radius of any successful exploitation attempts. Regular security audits and code reviews focusing on input validation practices across all user-facing endpoints remain essential for maintaining a robust defense posture against such injection-based attacks.