Is CVE-2026-116874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116874 being exploited in the wild.

How severe is CVE-2026-116874?

Medium severity, with a CVSS score of 6.1, published 27 October 2026.

Which products and versions are affected?

SemanticMediaWiki 3.1.0 before 7.3.1.

How is CVE-2026-116874 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116874?

Check whether you run SemanticMediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116874: SemanticMediaWiki reflected XSS in JsonResultPrinter

CVE-2026-116874 · Severity: medium · CVSS 6.1 · Published 2026-10-27

SemanticMediaWiki is a semantic search and data management extension for MediaWiki wikis. A reflected cross-site scripting (XSS) vulnerability in its JsonResultPrinter component allows unauthenticated attackers to inject and execute malicious JavaScript by crafting a malicious Special:Ask link. An attacker could exploit this to steal session cookies or CSRF tokens from victims, compromising their wiki accounts and enabling unauthorized actions.

Technologies: SemanticMediaWiki. Vendors: SemanticMediaWiki.

Quick answers

Is CVE-2026-116874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116874 being exploited in the wild.
How severe is CVE-2026-116874?: Medium severity, with a CVSS score of 6.1, published 27 October 2026.
Which products and versions are affected?: SemanticMediaWiki 3.1.0 before 7.3.1.
Is there a fix for CVE-2026-116874?: Yes: fixed in 7.3.1. Until then: Set Content-Type: application/json header for request_type=special_page responses to prevent browser interpretation as HTML, or apply HTML escaping (htmlspecialchars()) to the default parameter in JsonResultPrinter::getResultText().</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-27"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116874 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116874?: Check whether you run SemanticMediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.3.1

Set Content-Type: application/json header for request_type=special_page responses to prevent browser interpretation as HTML, or apply HTML escaping (htmlspecialchars()) to the default parameter in JsonResultPrinter::getResultText().</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-27"}]

Technical details

The vulnerability exists in JsonResultPrinter::getResultText(), which returns the user-supplied default parameter without HTML escaping when a zero-result query is executed in SMW_OUTPUT_FILE mode via Special:Ask with request_type=special_page. The response is served without a Content-Type header, causing browsers to render it as text/html and execute injected scripts. An unauthenticated attacker can craft a query guaranteed to return zero results and inject arbitrary JavaScript through the default parameter, which is echoed directly into the response.

Affected products

SemanticMediaWiki SemanticMediaWiki 3.1.0 before 7.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.