CVE-2026-116881 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
Semantic MediaWiki versions prior to 7.3.1 are susceptible to a stored cross-site scripting vulnerability that stems from improper input validation and output encoding within its semantic property handling mechanisms. This flaw specifically affects the autocomplete functionality used when users attempt to assign values to semantic properties on wiki pages. The root cause lies in how the backend API, PValueLookup, returns data which is then consumed by the frontend JavaScript library jquery.autocomplete.js. When a user interacts with the interface to select or search for property values, the system retrieves potential matches from the server and dynamically updates the dropdown menu using jQuery's html() method without sanitizing the incoming content.
The operational impact of this vulnerability allows an attacker who has write access to create pages containing malicious semantic properties. By injecting specially crafted markup into these properties, the attacker ensures that when another user attempts to use the autocomplete feature with an empty query or specific search terms, the raw, unsanitized payload is injected directly into the DOM structure of the dropdown list. This execution context within the browser allows for arbitrary JavaScript code execution under the security privileges of the victim's session. Consequently, attackers can perform actions such as stealing session cookies, hijacking user sessions, defacing web pages, or redirecting users to malicious external sites.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. From a tactical perspective, the attack vector corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based execution via DOM manipulation. The persistence aspect is notable because the malicious payload is stored in the database within semantic properties, meaning it remains active until manually removed or corrected by an administrator. This transforms a typically transient XSS flaw into a persistent threat that affects multiple users over time rather than just those who visit a specific crafted link once.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade Semantic MediaWiki to version 7.3.1 or later, where the developers have addressed this encoding issue by ensuring that all dynamic content inserted into the DOM via jQuery's html() method is properly escaped. In environments where upgrading is not immediately feasible, administrators should restrict write access to semantic properties to trusted users only and implement strict Content Security Policy headers to limit script execution sources. Additionally, input validation on the server side should be reinforced to reject or sanitize any HTML tags before they are stored in the database, ensuring that even if a vulnerability exists in the frontend rendering logic, no malicious markup is persisted for future retrieval.