AIKIDO-2026-428068

TL;DR

Semantic MediaWiki's Special:Ask keyset pagination decodes an unsigned, user-controlled cursor token whose sort_prop and sort_order fields are interpolated into a raw query error string when they do not match the request's sort order. That raw error bypasses the message layer's sanitisation and is emitted as raw HTML through the query error box, producing reflected cross-site scripting. A crafted cursor link runs script in the victim's browser without authentication. The fix output-encodes the cursor sort values before they enter the error text.