# CVE-2025-61682: Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

> CVE-2025-61682 (GitHub advisory GHSA-hg8h-557g-q8pp) is a high-severity vulnerability with a CVSS 3.1 base score of 8.6, classed as Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79), in mediawiki/semantic-media-wiki (Packagist). Affected versions: >= 3.1.0, < 7.0.0. It is fixed in 7.0.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-61682

| Field | Value |
| --- | --- |
| CVE | CVE-2025-61682 |
| GHSA | GHSA-hg8h-557g-q8pp |
| Severity | High |
| CVSS 3.1 | 8.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L` (GitHub Advisory Database) |
| CWE | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| EPSS | 0.29% (higher than 22% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable yes, technical impact partial |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.

##### Details

In `ext.smw.js`, the `data-subtab` attribute of all elements with the `smw-subtab` class is parsed as JSON and appended to the `innerHTML` of the element:
https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42
However, most data attributes (except for reserved ones) like `data-subtab` can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext.
The decoded (`"` will turn to `&quot;`, but it will be decoded when it is retrieved through `.dataset`) value of the `data-subtab` attribute in the payload is `"<img src='' onerror=alert(1)>"`. This is valid JSON and returns a string with `<img src='' onerror=alert(1)>` when being decoded.

##### PoC

1. Create a page with the following contents:
```html
{{#tag:div|
|class=smw-subtab
|data-subtab=""<img src='' onerror=alert(1)>""
}}
```
2. Visit the page

<img width="991" height="465" alt="image" src="https://github.com/user-attachments/assets/5d28d852-72d6-41dc-a59a-faac1610015f" />
<img width="497" height="69" alt="image" src="https://github.com/user-attachments/assets/02309390-0b40-46d9-b690-de8cd25dba59" />

##### Impact

Arbitrary HTML can be inserted into the DOM by any user with the `edit` right, allowing for JavaScript to be executed.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| mediawiki/semantic-media-wiki | Packagist | `pkg:composer/mediawiki/semantic-media-wiki` | >= 3.1.0, < 7.0.0 | 7.0.0 |

## Fix commits

- Release: https://github.com/semanticmediawiki/semanticmediawiki/commit/317dc05c8f14c5bf0e4eaae576b33540e2068593 (7.0.0)

## Questions

**What is the GHSA ID for CVE-2025-61682?**

GitHub tracks CVE-2025-61682 as GHSA-hg8h-557g-q8pp.

**What is the CVSS score of CVE-2025-61682?**

CVE-2025-61682 has a CVSS 3.1 base score of 8.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

**Which versions are affected by CVE-2025-61682?**

mediawiki/semantic-media-wiki (Packagist): >= 3.1.0, < 7.0.0.

**How do I fix CVE-2025-61682?**

Upgrade to 7.0.0 or later.

**What is the Package URL (PURL) for CVE-2025-61682?**

The affected package's PURL is pkg:composer/mediawiki/semantic-media-wiki.

**Is CVE-2025-61682 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-61682. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 22% of CVEs.

## References

- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-hg8h-557g-q8pp (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61682.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2025-61682 (advisory)
- https://github.com/advisories/GHSA-hg8h-557g-q8pp (advisory)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki (package)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.0.0

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-61682), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.