Semantic MediaWiki CVE-2026-116886

Requires an account (or anonymous user on wikis allowing anonymous editing) with ordinary page-edit rights; the 'External identifier' property type is user-selectable, so no special privilege beyond editing is needed. The flaw is present in the default configuration - the no-external-formatter-URI error path returns the raw caption - and also when a formatter URI is configured (raw caption as anchor body), so no non-default setup is required. The key limiting factor is passive user interaction (UI:P): a second user must actually view the Special:Browse page for the annotated subject for the payload to fire, and the privilege-escalation concern specifically depends on an administrator viewing that page. Impact is bounded to actions available within the viewer's session under the wiki origin.

This is a moderate-severity, low-urgency stored XSS (CWE-79) and the signals are internally consistent rather than conflicting. The CVSS 4.0 input vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 5.3) describes network reach, low complexity, and the need for victim interaction (UI:P) - a viewer must load the affected Special:Browse page - which caps impact to Low confidentiality/integrity with no availability effect. SSVC reinforces low priority: Exploitation=none (no observed exploitation), Automatable=yes (the inject step is scriptable), Technical Impact=partial. There is no CISA KEV listing, so this is not confirmed actively exploited; vuln.today assigns 'this_month', not act_now/emergency. One nuance on privileges: the CVSS vector encodes PR:N, but the description and advisory state that exploitation requires page-edit rights - PR:N is only accurate on wikis that permit anonymous editing, otherwise a low-privileged authenticated editor is required. EPSS is not provided in the input, so exploitation probability cannot be quantified. Net: a genuine but not emergency issue - real impact is bounded by required editor access and required victim page views, with the standout concern being that an administrator viewing the crafted Browse page executes the payload in their privileged session.

A low-privileged editor declares a property of type 'External identifier' and annotates a payload such as [[Eid::<img src=x onerror=alert(document.domain)>]] on a content page. When any other user - potentially an administrator - later visits Special:Browse for that subject, ExternalIdentifierValue emits the caption unescaped and the JavaScript runs in the viewer's authenticated session under the wiki origin. The GHSA advisory includes a step-by-step proof of concept; a public PoC reference exists, though it is not verified in the input as a packaged working exploit.