AIKIDO-2026-579282

mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-q5fm-9mx6-44f4 Published 4 days ago

Medium Risk

This Affects:

mediawiki/semantic-media-wiki

0.0.1 - 7.1.0

Fixed in 7.2.0

Are you affected? Scan for Free

TL;DR

Semantic MediaWiki assembles query debug output (format=debug, or the debug parameter on Special:Ask) in DebugFormatter and emits it as raw HTML. Several sinks apply no output-context encoding, so user-controlled query values reflected through the serialized ASK string, the generated SQL, or the EXPLAIN output are rendered without escaping. Targeting a text-typed property that ships on every install lets an anonymous request execute script in the victim's browser. The fix applies output-context escaping at the DebugFormatter boundary for entry values, SQL, and EXPLAIN strings.

Who does this affect?

You are affected if you run an affected version and allow query debug output (format=debug, or the debug parameter on Special:Ask), which is available by default. A crafted query targeting a text-typed property that ships on every install reflects untrusted input as raw HTML; no authentication or special rights are required.