AIKIDO-2026-735946

mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-3jp5-3h47-28qf Published 4 days ago

Medium Risk

This Affects:

mediawiki/semantic-media-wiki

0.0.1 - 7.1.0

Fixed in 7.2.0

Are you affected? Scan for Free

TL;DR

Semantic MediaWiki renders Special:Ask result tables, and when headers=plain is requested the table header text is emitted through a raw HTML path. User-controlled mainlabel or property label content is placed into the header without output-context escaping, so markup in that value becomes executable HTML. A crafted request reflects the payload into the response and runs script in the victim's browser on the wiki origin without authentication. The fix escapes plain header values in TableResultPrinter before they reach the table renderer.

Who does this affect?

You are affected if you run an affected version and expose Special:Ask, which is enabled by default. The vulnerable path is reached when a result table is rendered with headers=plain and user-controlled mainlabel/label content; no login or special permission is required, and the payload is delivered through a crafted link.