Semantic MediaWiki CVE-2026-116881

The property-value autocomplete widget must be enabled, and the attacker must be able to introduce an untrusted semantic property value (via editing or an untrusted import source) that the PValueLookup API returns. Exploitation then requires a second user to open that property-value autocomplete with an empty query (the passive interaction captured as UI:P), at which point jquery.autocomplete.js concatenates the raw value into HTML and calls container.html(). Limiting factors: it is stored rather than directly remote-triggerable (the attacker-controlled value must first be persisted and served by the API); it needs the specific widget enabled; it needs a victim to open the empty-query dropdown; and the confirmed impact is limited to markup injection - the GHSA only states script execution 'may' occur if the browser context accepts an executable construct, so full JavaScript execution is not demonstrated.

This is a stored/DOM cross-site scripting issue (CWE-79) with a vendor-assigned CVSS 4.0 base score of 5.3 (medium), reflecting network vector (AV:N), low complexity (AC:L), no privileges in the supplied vector (PR:N), passive user interaction (UI:P), and only Low confidentiality/integrity impact on both the vulnerable and a subsequent system (VC:L/VI:L/VA:N, SC:L/SI:L/SA:N). No EPSS exploitation-probability score was provided, it is not listed in CISA KEV, and the only proof of concept is the GHSA's deliberately inert marker that injects a benign <span> and explicitly does not execute JavaScript - so exploitation status is a public PoC reference that is not verified as working exploit code. These signals are consistent and point to a real but non-urgent issue rather than a high-severity emergency: the vuln.today Decision label is 'this_month', not act_now/emergency. The practical ceiling is uncertain - the GHSA itself only claims an attacker 'may obtain script-capable behavior if the browser context accepts an executable construct', i.e. markup injection is confirmed but full script execution is not demonstrated. One conflict must be flagged explicitly: the multi-source metadata says 'Patch: Available from vendor' and the composer package data lists 'fixed in 7.3.1', yet the GHSA advisory states 'No patched release is known from the checked history' and that it only assessed 7.3.0 and 7.3.1-alpha - verify the fixed version directly with the vendor before relying on 7.3.1.

An attacker introduces a semantic property value containing HTML markup (by editing a wiki page they can edit, or via a deployment that imports values from an untrusted source). Later, another user focuses the property-value autocomplete widget without typing, triggering an empty-query PValueLookup response whose raw value is concatenated into the dropdown via container.html(), injecting the attacker's markup into that user's browser. A safe, non-executing PoC in the GHSA confirms the markup injection; whether it escalates to script execution depends on the browser context accepting an executable construct.