AIKIDO-2026-428068

mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-cx86-7xwp-w9wf Published 4 days ago

Medium Risk

This Affects:

mediawiki/semantic-media-wiki

7.0.0 - 7.1.0

Fixed in 7.2.0

Are you affected? Scan for Free

TL;DR

Semantic MediaWiki's Special:Ask keyset pagination decodes an unsigned, user-controlled cursor token whose sort_prop and sort_order fields are interpolated into a raw query error string when they do not match the request's sort order. That raw error bypasses the message layer's sanitisation and is emitted as raw HTML through the query error box, producing reflected cross-site scripting. A crafted cursor link runs script in the victim's browser without authentication. The fix output-encodes the cursor sort values before they enter the error text.

Who does this affect?

You are affected if you run 7.0.0 through 7.1.0 with Special:Ask exposed, which is enabled by default; keyset cursor pagination was introduced in 7.0.0, so earlier releases lack this sink entirely. A crafted cursor token delivered by link triggers the reflected error with no authentication or special rights.