Summary
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Advisory details
Failure mode
The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.
Remediation
- The form value is escaped before it is placed back into the input field.
- Derived error messages are also escaped before being rendered into HTML.
Maintenance note
Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
References
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- CRITICALCVE-2026-104252
Vitess vttablet /twopcz reflected XSS
- MEDIUMCVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation
- HIGHCVE-2026-96230
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
- HIGHCVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
- CRITICALCVE-2026-107845
Contao: Cross-site scripting in the comments bundle