Semantic MediaWiki CVE-2026-116882

Exploitation requires an authenticated account holding the permission to edit the FacetedSearch profile or its backing schema (profile or schema editor); the malicious label is stored at data/schema/facetedsearch-profile-schema.v1.json and surfaced via Profile::get(). Triggering is passive but still requires a victim to open the corresponding Special:FacetedSearch exploration list (UI:P). A further critical limiter per the vendor: the injected markup only reaches JavaScript execution where the specific deployment permits an executable HTML context - otherwise the impact is limited to editor-controlled UI alteration/defacement. These prerequisites (privileged editor role plus victim page visit plus permissive HTML context) narrow realistic exploitation well below what the CWE-79 label alone suggests.

This is a genuinely low-to-moderate priority issue despite the CWE-79 label, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) scores only 4.8 (Medium) and correctly reflects two strong limiting factors: the attacker must already hold a privileged role (PR:H - profile or schema editor permission) and a victim must actively open the Special:FacetedSearch page (UI:P/Passive). SSVC reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. The vuln.today decision label is 'this_month', not act_now or emergency. It is not in CISA KEV, so this is not actively exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed - this is a data gap, not a signal of either high or low risk. A PoC exists but, per the advisory, it is a deliberately inert marker that does NOT execute JavaScript; actual script execution is explicitly conditional on the deployment permitting an executable HTML context, so the realistic worst case for many installs is UI defacement rather than full XSS. The requirement for an already-trusted editor account substantially narrows the practical attacker population to insiders or compromised privileged accounts.

A user who already holds profile or schema editor permissions on a Semantic MediaWiki wiki stores HTML markup in a FacetedSearch exploration-link label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(). When another user later opens the Special:FacetedSearch page, the attacker-controlled markup is rendered as raw anchor content, altering the page and, where the deployment permits an executable HTML context, running script in the viewer's browser. A public PoC reference exists but it is an inert marker that does not execute JavaScript, so it is not verified as working exploit code.