Medium severity6.1NVD Advisory· Published Oct 27, 2026

CVE-2026-116889

Description

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.

Affected products

Semantic Mediawiki/Semantic Mediawikillm-fuzzy
Range: <7.3.1

Patches

Vulnerability mechanics

References

github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-6v7f-crgp-hhvpnvd
www.vulncheck.com/advisories/semanticmediawiki-2.5.0-before-7.3.1-stored-xss-via-special-browse-code-propertynvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000