CVE-2026-116889 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
SemanticMediaWiki versions ranging from 2.5.0 up to but not including 7.3.1 are susceptible to a stored cross-site scripting vulnerability that stems from improper neutralization of input within code-typed property values. This flaw allows authenticated users who possess page-editing privileges to inject malicious script payloads into the application's database by annotating valid JSON structures with embedded HTML markup. The core technical failure occurs in the CodeStringValueFormatter component, which is responsible for rendering these specific data types on the Special:Browse interface. Instead of sanitizing or encoding the input before display, the formatter outputs the content directly to the browser without escaping special characters such as angle brackets and quotes. This lack of output encoding permits the execution of arbitrary JavaScript code in the context of any user who views the affected page, effectively turning a data entry feature into an attack vector for persistent client-side attacks.
The operational impact of this vulnerability is significant because it leverages stored persistence rather than reflected injection. Once the malicious payload is saved via the Code-typed property, every subsequent viewer of that specific wiki page will have their session compromised upon loading the content in a vulnerable browser environment. Attackers can exploit this to steal sensitive user credentials, hijack active sessions by exfiltrating cookies or authentication tokens, perform actions on behalf of victims such as modifying data or changing settings, and potentially pivot into further network attacks if internal resources are accessible from the victim's context. Since the attack requires only page-edit rights rather than administrative access, a larger pool of potential attackers exists within typical wiki deployments where multiple contributors have write permissions to ensure content accuracy and completeness.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the application failing to properly validate or encode user-supplied input before including it in web pages served to other users. In terms of adversary tactics, this behavior maps directly to the ATT&CK technique T1059 Command and Scripting Interpreter under the Execution tactic, specifically when used for client-side script execution via browser-based interpreters like JavaScript. The persistence aspect also relates to CWE-642 External Control of Critical State which allows attackers to maintain footholds by embedding malicious logic within legitimate data structures that are routinely accessed by multiple users over time.
Mitigation strategies should prioritize immediate patching to the latest stable version of SemanticMediaWiki, specifically 7.3.1 or later where this issue has been addressed through improved input validation and output encoding practices. For environments unable to upgrade immediately, administrators can implement a Web Application Firewall rule set that detects and blocks attempts to inject script tags or event handlers within JSON payloads submitted via the wiki's editing interfaces. Additionally enforcing strict Content Security Policy headers on the web server can significantly reduce the impact by restricting the sources from which scripts are allowed to execute, thereby preventing the injected code from running even if it is successfully rendered in the DOM. Regular audits of user permissions should also be conducted to ensure that page-edit rights are granted only to trusted individuals who understand security implications and follow safe data entry practices.