CVE-2026-116884 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in SemanticMediaWiki versions prior to 7.3.1 represents a critical stored cross-site scripting flaw located within the ext.smw.tooltip.tippy.js module. This component is responsible for rendering tooltips and supplementary data visualizations on wiki pages that utilize Semantic MediaWiki extensions. The core technical failure stems from how the JavaScript library handles HTML content injection when the allowHTML configuration option is enabled. Specifically, the code utilizes innerHTML to render attributes such as data-content, data-title, data-top, data-bottom, or data-theme without adequate sanitization of script execution contexts. This architectural decision allows user-supplied input that contains executable JavaScript payloads to be processed directly by the browser's rendering engine rather than being treated as inert text data.
The impact of this vulnerability is severe due to its stored nature and broad scope of potential victims. An attacker with editor privileges can inject malicious code into wiki pages, which remains persistent until removed from the database. When any user, including high-privilege administrators or system owners, views a page containing the compromised element and hovers over it, the browser executes the embedded JavaScript payload in the context of the victim's session. This mechanism facilitates account takeover, session hijacking, credential theft via keylogging scripts, defacement of the wiki interface, or redirection to malicious external sites. Because SemanticMediaWiki is often deployed in enterprise environments for knowledge management and data integration, such an exploit can lead to significant operational disruption and compromise of sensitive organizational information stored within the platform.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific variant is classified under Stored XSS where malicious scripts are permanently stored within target servers such as databases or message boards. In terms of adversary tactics and techniques, the exploitation path corresponds to ATT&CK technique T1059 Command and Scripting Interpreter with sub-techniques involving JavaScript execution in a browser environment. Furthermore, the attack vector leverages user interaction through hover events which may be categorized under social engineering aspects if disguised as legitimate content, though technically it falls under client-side code injection via trusted input sources that fail to validate output encoding properly.
Mitigation strategies must address both immediate remediation and long-term security hardening. The primary solution is to upgrade SemanticMediaWiki to version 7.3.1 or later where the vulnerability has been patched by implementing stricter sanitization protocols for tooltip attributes before they are rendered via innerHTML. Administrators should also consider disabling the allowHTML option if rich text formatting in tooltips is not strictly required, thereby forcing plain text rendering which neutralizes script execution risks. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking XSS payloads in HTTP requests can provide an additional layer of defense against exploitation attempts while patching efforts are underway. Regular security audits focusing on input validation and output encoding practices across all custom extensions will help prevent similar vulnerabilities from being introduced into the codebase in future updates.