https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:29:25 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-61682 <p>Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.</p> <p>Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-61682 https://vulnerability.circl.lu/vuln/ghsa-hg8h-557g-q8pp <p><strong>Affected:</strong> Packagist: mediawiki/semantic-media-wiki</p> <p>### Summary The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.</p> <p>### Details</p> <p>In `ext.smw.js`, the `data-subtab` attribute of all elements with the `smw-subtab` class is parsed as JSON and appended to the `innerHTML` of the element: https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42 However, most data attributes (except for reserved ones) like `data-subtab` can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext. The decoded (`&#34;` will turn to `&amp;quot;`, but it will be decoded when it is retrieved through `.dataset`) value of the `data-subtab` attribute in the payload is `&#34;&lt;img src=&#39;&#39; onerror=alert(1)&gt;&#34;`. This is valid JSON and returns a string with `&lt;img src=&#39;&#39; onerror=alert(1)&gt;` when being decoded.</p> <p>### PoC</p> <p>1. Create a page with the following contents: ```html {{#tag:div| |class=smw-subtab |data-subtab=&#34;&#34;&lt;img src=&#39;&#39; onerror=alert(1)&gt;&#34;&#34; }} ``` 2. Visit the page</p> <p>&lt;img width=&#34;991&#34; height=&#34;465&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/5d28d852-72d6-41dc-a59a-faac1610015f&#34; /&gt; &lt;img width=&#34;497&#34; height=&#34;69&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/02309390-0b40-46d9-b690-de8cd25dba59&#34; /&gt;</p> <p>### Impact</p> <p>Arbitrary HTML can be inserted into the DOM by any user with the `edit` right, allowing for JavaScript to be executed.</p> <p><strong>Affected:</strong> Packagist: mediawiki/semantic-media-wiki</p> <p>### Summary The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.</p> <p>### Details</p> <p>In `ext.smw.js`, the `data-subtab` attribute of all elements with the `smw-subtab` class is parsed as JSON and appended to the `innerHTML` of the element: https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42 However, most data attributes (except for reserved ones) like `data-subtab` can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext. The decoded (`&#34;` will turn to `&amp;quot;`, but it will be decoded when it is retrieved through `.dataset`) value of the `data-subtab` attribute in the payload is `&#34;&lt;img src=&#39;&#39; onerror=alert(1)&gt;&#34;`. This is valid JSON and returns a string with `&lt;img src=&#39;&#39; onerror=alert(1)&gt;` when being decoded.</p> <p>### PoC</p> <p>1. Create a page with the following contents: ```html {{#tag:div| |class=smw-subtab |data-subtab=&#34;&#34;&lt;img src=&#39;&#39; onerror=alert(1)&gt;&#34;&#34; }} ``` 2. Visit the page</p> <p>&lt;img width=&#34;991&#34; height=&#34;465&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/5d28d852-72d6-41dc-a59a-faac1610015f&#34; /&gt; &lt;img width=&#34;497&#34; height=&#34;69&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/02309390-0b40-46d9-b690-de8cd25dba59&#34; /&gt;</p> <p>### Impact</p> <p>Arbitrary HTML can be inserted into the DOM by any user with the `edit` right, allowing for JavaScript to be executed.</p> https://vulnerability.circl.lu/vuln/ghsa-hg8h-557g-q8pp