Executive brief
Semantic MediaWiki is a MediaWiki extension that enables structured data management within wiki pages. A vulnerability allows any user with edit permissions to inject arbitrary JavaScript code by crafting specially-formed wikitext, which is then executed in the browsers of all users viewing the affected page. This could lead to session hijacking, credential theft, or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability caused by improper handling of HTML data attributes in the ext.smw.js JavaScript file. The vulnerable code parses the `data-subtab` attribute of elements with the `smw-subtab` class as JSON and directly appends it to the element's `innerHTML` without sanitization. Since non-reserved data attributes can be specified in MediaWiki wikitext markup using the `{{#tag:div}}` syntax, an attacker with edit permissions can craft a payload containing JavaScript-executing HTML (e.g., `<img src='' onerror=alert(1)>`) that will be parsed and executed when the page loads. No user interaction or special privileges beyond basic edit rights are required to exploit this vulnerability. The vulnerability affects all versions from 3.1.0 through 6.x, and is fixed in version 7.0.0 and later.
Affected products
- Semantic MediaWiki Semantic MediaWiki 3.1.0 through 6.x (fixed in 7.0.0)
Timeline
- 2026-09-15: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-09-15: patched: Fix released in version 7.0.0