CVE-2025-61682
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
- Record
CVE-2025-61682- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-210943
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
- Record
EUVD-2025-210943- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hg8h-557g-q8pp
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Summary
The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.
Details
In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of the element:
https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42
However, most data attributes (except for reserved ones) like data-subtab can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext.
The decoded (" will turn to ", but it will be decoded when it is retrieved through .dataset) value of the data-subtab attribute in the payload is "<img src='' onerror=alert(1)>". This is valid JSON and returns a string with <img src='' onerror=alert(1)> when being decoded.
PoC
- Create a page with the following contents:
{{#tag:div|
|class=smw-subtab
|data-subtab=""<img src='' onerror=alert(1)>""
}}
- Visit the page
<img width="991" height="465" alt="image" src="https://github.com/user-attachments/assets/5d28d852-72d6-41dc-a59a-faac1610015f" /> <img width="497" height="69" alt="image" src="https://github.com/user-attachments/assets/02309390-0b40-46d9-b690-de8cd25dba59" />
Impact
Arbitrary HTML can be inserted into the DOM by any user with the edit right, allowing for JavaScript to be executed.
- Record
GHSA-hg8h-557g-q8pp- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
- Record
CVE-2025-61682- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
- Record
CVE-2025-61682- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-hg8h-557g-q8pp
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Summary
The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.
Details
In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of the element:
https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42
However, most data attributes (except for reserved ones) like data-subtab can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext.
The decoded (" will turn to ", but it will be decoded when it is retrieved through .dataset) value of the data-subtab attribute in the payload is "<img src='' onerror=alert(1)>". This is valid JSON and returns a string with <img src='' onerror=alert(1)> when being decoded.
PoC
- Create a page with the following contents:
{{#tag:div|
|class=smw-subtab
|data-subtab=""<img src='' onerror=alert(1)>""
}}
- Visit the page
<img width="991" height="465" alt="image" src="https://github.com/user-attachments/assets/5d28d852-72d6-41dc-a59a-faac1610015f" /> <img width="497" height="69" alt="image" src="https://github.com/user-attachments/assets/02309390-0b40-46d9-b690-de8cd25dba59" />
Impact
Arbitrary HTML can be inserted into the DOM by any user with the edit right, allowing for JavaScript to be executed.
- Record
GHSA-hg8h-557g-q8pp- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/semantic-media-wikiPackagist |
3.1.0 up to 7.0.0 | 7.0.0 |
mediawiki/semantic-media-wikiPackagist |
3.1.0 up to 7.0.0, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 Show 21 moreShow less3.1.63.2.03.2.0-rc.13.2.0-rc.23.2.13.2.23.2.34.0.04.0.14.0.24.1.04.1.14.1.24.1.34.2.05.0.05.0.15.0.25.1.06.0.06.0.1 |
7.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-61682 is a high vulnerability (CVSS 8.6) in Semanticmediawiki, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in mediawiki/semantic-media-wiki 7.0.0.
References
github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-hg8h-557g-q8pp
nvd.nist.gov/vuln/detail/CVE-2025-61682