AIKIDO-2026-612940
mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS)
61
CVE Score
Medium
Cross-Site Scripting (XSS)
TL;DR
Semantic MediaWiki's Special:SearchByProperty reflects the user-supplied property and value request parameters back into the rendered form field, validation error messages, and result heading. These values are emitted without sufficient output-context encoding, so markup supplied through property or value becomes executable HTML in the response. A crafted link reflects the payload and runs script in the victim's browser without authentication. The fix escapes the form value and derived error messages before they are rendered into HTML.
How do I fix this?
Upgrade the mediawiki/semantic-media-wiki library to the patch version.
Who does this affect?
You are affected if you run an affected version with Special:SearchByProperty reachable, which is enabled by default. A crafted link supplying property/value reflects untrusted input into the rendered form field and error text; exploitation requires no authentication or special permissions.
Versions
0.0.1 - 7.1.0
Fixed in 7.2.0Background info
mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 7.1.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.