LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19329: In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in r...

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes a cross-site scripting flaw in the Wikibase Wikidata Query Service GUI. Older GUI builds could execute arbitrary JavaScript when mathematical expressions in results were rendered directly. The issue was addressed by switching math rendering to MathJax, and the affected GUI code is no longer bundled with newer service snapshots.

Executive priority

Treat this as a legacy exposure cleanup item unless an affected public GUI is confirmed. If confirmed on an internet-facing service, prioritize remediation because successful exploitation could compromise user browser sessions and trust in the service.

Technical view

The vulnerable component is Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT dated 2019-11-07. The CVE states that directly displayed mathematical expressions in results could lead to arbitrary JavaScript execution. Public metadata does not provide CVSS, CWE, detailed affected CPEs, or confirmed exploitation evidence.

Likely exposure

Exposure is most likely in legacy or forked deployments still running the old Wikibase Wikidata Query Service GUI. Newer snapshots reportedly no longer bundle this GUI code, which reduces likely exposure for standard maintained deployments.

Exploitation context

The source bundle does not show CISA KEV listing or other cited evidence of active exploitation. Impact is browser-side script execution in the GUI context when vulnerable result rendering is reached, but the provided sources do not define attack preconditions in detail.

Researcher notes

The record is sparse: no CVSS, CWE, CPE, or exploit-status details are included. The strongest facts are the affected GUI version boundary, XSS behavior, MathJax remediation, and note that newer snapshots no longer bundle the GUI code.

Mitigation direction

  • Upgrade away from GUI builds before 0.3.6-SNAPSHOT 2019-11-07.
  • Use the fixed GUI code that introduced MathJax rendering.
  • Retire legacy bundled GUI copies if they remain deployed.
  • Check Wikimedia project guidance for deployment-specific remediation.
  • Restrict public access while legacy exposure is being assessed.

Validation and detection

  • Inventory Wikibase Wikidata Query Service GUI deployments and forks.
  • Confirm deployed GUI version or commit date is after 2019-11-07.
  • Verify math result rendering uses MathJax rather than direct display.
  • Review whether the vulnerable GUI is publicly reachable.
  • Document findings for legacy systems without clear version metadata.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-19329 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.