Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Failure mode
sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (request_type=raw), so the injection was reachable without authentication.
Remediation
- In all non-wiki output modes (HTML, raw request, file),
sepis escaped unless it is a safe<br>variant. - This preserves legitimate line-break separators while blocking markup injection.
Maintenance note
If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | mediawiki/semantic-media-wiki | < 7.2.0 | 7.2.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
mediawiki/semantic-media-wiki- Disclosed
- 18.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7xv3-gf2g-498h - CC BY 4.0
Vulnerability history: mediawiki/semantic-media-wiki
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 12.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 9
-
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.