AIKIDO-2026-579282

TL;DR

Semantic MediaWiki assembles query debug output (format=debug, or the debug parameter on Special:Ask) in DebugFormatter and emits it as raw HTML. Several sinks apply no output-context encoding, so user-controlled query values reflected through the serialized ASK string, the generated SQL, or the EXPLAIN output are rendered without escaping. Targeting a text-typed property that ships on every install lets an anonymous request execute script in the victim's browser. The fix applies output-context escaping at the DebugFormatter boundary for entry values, SQL, and EXPLAIN strings.