Medium severity6.1NVD Advisory· Published Nov 27, 2019· Updated Jun 17, 2026

CVE-2019-19328

Description

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wikibase/Wikibase Wikidata Query Service GUIdescription
Wikidata Query Service GUI/Wikidata Query Service GUIllm-create
Range: <0.3.6-SNAPSHOT 2019-11-07
Wikimedia Foundation/Wikibasellm-fuzzy
Range: <0.3.6-SNAPSHOT 2019-11-07

Patches

Vulnerability mechanics

References

gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90dnvdMailing ListPatchVendor Advisory
gerrit.wikimedia.org/r/nvdMailing ListPatchVendor Advisory
lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.htmlnvdMailing ListPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000