Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Failure mode
When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.
Remediation
TableResultPrinternow applies output-context escaping before passing plain headers to the table renderer.- The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | mediawiki/semantic-media-wiki | < 7.2.0 | 7.2.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
mediawiki/semantic-media-wiki- Disclosed
- 18.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3jp5-3h47-28qf - CC BY 4.0
Vulnerability history: mediawiki/semantic-media-wiki
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 12.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 9
-
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.