Quick answers
- Is CVE-2026-116881 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116881 being exploited in the wild.
- How severe is CVE-2026-116881?
- Medium severity, with a CVSS score of 6.1, published 27 October 2026.
- Which products and versions are affected?
- Semantic MediaWiki 3.0.0 before 7.3.1.
- Is there a fix for CVE-2026-116881?
- Yes: fixed in 7.3.1. Until then: Disable the property-value autocomplete widget if it is not required, or restrict the ability to create or modify semantic properties to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116881 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116881?
- Check whether you run Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.3.1
Disable the property-value autocomplete widget if it is not required, or restrict the ability to create or modify semantic properties to trusted users only.
Technical details
A cross-site scripting vulnerability exists in the property-value autocomplete widget where the PValueLookup API returns unescaped semantic values that are directly concatenated into HTML via jQuery's .html() method in jquery.autocomplete.js. When a user opens the autocomplete with an empty query, an attacker-controlled property value can inject arbitrary markup or scripts into the dropdown. The vulnerability requires the property-value autocomplete to be enabled and user interaction to trigger the autocomplete dropdown.
Affected products
- Semantic MediaWiki Semantic MediaWiki 3.0.0 before 7.3.1
Timeline
- 2026-09-28: disclosed
- 2026-10-27: advisory