AIKIDO-2026-819973

mediawiki/semantic-media-wiki is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-7xv3-gf2g-498h Published 4 days ago

Medium Risk

This Affects:

mediawiki/semantic-media-wiki

0.0.1 - 7.1.0

Fixed in 7.2.0

Are you affected? Scan for Free

TL;DR

Semantic MediaWiki's Special:Ask table output inserts the user-controlled sep separator verbatim into the HTML that joins a table cell's values. Because the separator is not escaped, markup supplied through sep is injected into the page, and the same unsanitised table HTML is produced for the standard render and for the raw request output (request_type=raw). The reflected value executes script in the victim's browser without authentication. The fix escapes sep in all non-wiki output modes unless it is a safe line-break variant.

Who does this affect?

You are affected if you run an affected version and expose Special:Ask, which is enabled by default. The vulnerable path is a table query carrying a user-controlled sep separator, reachable through both the normal render and the raw request output (request_type=raw); no authentication is required and the payload arrives via a crafted link.