Skip to content
CVE IDCVE-2025-61682GitHub advisory IDGHSA-hg8h-557g-q8pp

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

CVE-2025-61682 (GitHub advisory GHSA-hg8h-557g-q8pp) is a high-severity vulnerability with a CVSS 3.1 base score of 8.6, classed as Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79), in mediawiki/semantic-media-wiki (Packagist). Affected versions: >= 3.1.0, < 7.0.0. It is fixed in 7.0.0.

High8.6Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

8.6HighCVSS 3.1
CVE ID
CVE-2025-61682
GHSA ID
GHSA-hg8h-557g-q8pp
EPSS
0.29%higher than 22% of CVEs
Weakness (CWE)
  • CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • Packagist (PHP)
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.

Details

In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of the element: https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42 However, most data attributes (except for reserved ones) like data-subtab can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext. The decoded (" will turn to &quot;, but it will be decoded when it is retrieved through .dataset) value of the data-subtab attribute in the payload is "<img src='' onerror=alert(1)>". This is valid JSON and returns a string with <img src='' onerror=alert(1)> when being decoded.

PoC

  1. Create a page with the following contents:
{{#tag:div|
|class=smw-subtab
|data-subtab=""<img src='' onerror=alert(1)>""
}}
  1. Visit the page

Impact

Arbitrary HTML can be inserted into the DOM by any user with the edit right, allowing for JavaScript to be executed.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

High8.6Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
High
Integrity I
Low
Availability A
Low

CISA SSVC decision points

Exploitation
poc
Proof-of-concept code is public
Automatable
yes
Attackers can automate this at scale
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • mediawiki/semantic-media-wiki
    Packagist (PHP)
    pkg:composer/mediawiki/semantic-media-wiki
    Affected versions
    >= 3.1.0, < 7.0.0
    Fixed in
    7.0.0
    Show 27 listed versions
    • 3.1.0
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 3.1.4
    • 3.1.5
    • 3.1.6
    • 3.2.0
    • 3.2.0-rc.1
    • 3.2.0-rc.2
    • 3.2.1
    • 3.2.2

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 7.0.0 or later.

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 317dc05Release commit7.0.0github.com/semanticmediawiki/semanticmediawiki

Vulnerability intelligence

References

Credits

Questions about CVE-2025-61682

What is the GHSA ID for CVE-2025-61682?
GitHub tracks CVE-2025-61682 as GHSA-hg8h-557g-q8pp.
What is the CVSS score of CVE-2025-61682?
CVE-2025-61682 has a CVSS 3.1 base score of 8.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Which versions are affected by CVE-2025-61682?
mediawiki/semantic-media-wiki (Packagist): >= 3.1.0, < 7.0.0.
How do I fix CVE-2025-61682?
Upgrade to 7.0.0 or later.
What is the Package URL (PURL) for CVE-2025-61682?
The affected package's PURL is pkg:composer/mediawiki/semantic-media-wiki.
Is CVE-2025-61682 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-61682. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 22% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 5 days ago (8 Oct 2026, 23:02 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.