CVE-2025-61682: Semantic MediaWiki Stored XSS Vulnerability

CVE-2025-61682 Overview

CVE-2025-61682 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Semantic MediaWiki, an open-source extension to MediaWiki that stores and queries structured data within wiki pages. The extension inserts the unsanitized value of a data attribute directly into the Document Object Model (DOM) as HTML. An attacker who can edit wikitext can persist malicious markup that executes in the browsers of subsequent visitors. Versions from 3.1.0 up to (but not including) 7.0.0 are affected. Release 7.0.0 patches the flaw.

Critical Impact
Any user with wikitext edit rights can plant stored XSS payloads that execute against every visitor to the affected page, enabling session theft, privilege escalation through administrator sessions, and full wiki compromise.

Affected Products

Semantic MediaWiki 3.1.0 through 6.x
Semantic MediaWiki versions prior to 7.0.0
MediaWiki instances that install the Semantic MediaWiki extension

Discovery Timeline

2026-09-18 - CVE-2025-61682 published to the National Vulnerability Database
2026-09-24 - Record last modified in NVD

Technical Details for CVE-2025-61682

Vulnerability Analysis

Semantic MediaWiki extends MediaWiki with typed properties, inline queries, and semantic annotations rendered into HTML output. In affected versions, one of the extension's rendering paths reads a value from a data attribute and inserts it back into the DOM as HTML rather than as text content. Because wikitext editors can influence that attribute value, they can inject arbitrary HTML and JavaScript that is stored in the wiki page and executed in the browser of every subsequent viewer.

Stored XSS in a wiki context is particularly consequential. Payloads persist inside content pages, templates, or property definitions that are reused across the site. Execution occurs under the origin of the wiki, granting the attacker access to session cookies, CSRF tokens, and any editing privileges the victim holds — including administrator accounts.

Root Cause

The root cause is missing output encoding on a value that is round-tripped through a data attribute. Client-side code treats the attribute value as trusted markup and assigns it to a container using an HTML-parsing sink instead of a text-only sink. The upstream fix in release 7.0.0 restores proper escaping so the value is rendered as inert text.

Attack Vector

Exploitation requires only the ability to save wikitext that flows into the vulnerable rendering path. An authenticated (or, on open wikis, unauthenticated) editor crafts wikitext containing a payload that ends up inside the affected data attribute. When any user renders the page, the client-side handler reinserts the attribute value into the DOM as HTML and the script executes in the visitor's session.

Refer to the GitHub Security Advisory GHSA-hg8h-557g-q8pp for maintainer-provided technical details.

Detection Methods for CVE-2025-61682

Indicators of Compromise

Wiki revisions containing unusual HTML control characters, <script> fragments, or event-handler attributes (onerror, onload, onclick) inside semantic annotations or property values.
Outbound browser requests from wiki users to unfamiliar domains immediately after page load, indicating token or cookie exfiltration.
Unexpected administrative actions (permission changes, user creation, extension configuration edits) originating from privileged accounts shortly after visiting a modified page.

Detection Strategies

Audit page histories for edits that introduce raw HTML into semantic properties or data-carrying markup, especially from newly registered or low-reputation accounts.
Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for inline script execution originating from wiki content pages.
Scan the running MediaWiki installation for the Semantic MediaWiki version string and flag any deployment reporting a version between 3.1.0 and 6.x.

Monitoring Recommendations

Forward MediaWiki access and edit logs to a centralized logging platform and alert on high-volume edits targeting semantic properties.
Monitor browser telemetry from administrator workstations for anomalous script execution on wiki origins.
Track HTTP responses for the presence of unencoded angle brackets inside data attributes generated by Semantic MediaWiki output.

How to Mitigate CVE-2025-61682

Immediate Actions Required

Upgrade Semantic MediaWiki to version 7.0.0 or later on all MediaWiki instances.
Review recent wikitext edits made while a vulnerable version was deployed and revert entries that contain suspicious HTML or JavaScript payloads.
Rotate session cookies and force reauthentication for privileged wiki accounts that visited potentially affected pages.

Patch Information

The maintainers fixed CVE-2025-61682 in Semantic MediaWiki Release 7.0.0. Administrators should follow the standard MediaWiki extension update procedure: pull the tagged release, run composer update, execute php maintenance/update.php, and clear the parser cache so cached HTML containing the vulnerable output is regenerated.

Workarounds

Restrict wikitext edit permissions to trusted accounts until the upgrade to 7.0.0 is complete.
Enforce a strict Content Security Policy that disallows inline scripts on the wiki origin to reduce the impact of stored XSS payloads.
Temporarily disable Semantic MediaWiki features that render user-controlled data attributes if immediate patching is not feasible.

bash

# Upgrade Semantic MediaWiki to the patched release
cd /var/www/mediawiki
composer require mediawiki/semantic-media-wiki "~7.0"
php maintenance/update.php --quick
php maintenance/rebuildall.php