CVE-2025-61682: Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

September 18, 2026

The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.

References

github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.0.0
github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-hg8h-557g-q8pp
github.com/advisories/GHSA-hg8h-557g-q8pp
nvd.nist.gov/vuln/detail/CVE-2025-61682

Code Behaviors & Features

Detect and mitigate CVE-2025-61682 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →