CVE-2026-77606: Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Failure mode
When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.
Remediation
- TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
Other sources
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/semantic-media-wikito a version that resolves this vulnerability.Fixed in 7.2.0 - Upgrade
Upgrade
Semantic MediaWikito a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to induce a user to view a Special:Ask result that uses headers=plain and contains attacker-controlled mainlabel content. No attacker privileges are required, but user interaction is required.
Are default query configurations affected?
The issue is specifically tied to queries using the headers=plain setting. The provided information does not indicate that other header configurations are affected.
What should be done if upgrading cannot happen immediately?
Avoid or remove use of headers=plain in Special:Ask queries, particularly where mainlabel content may be influenced by untrusted users. Upgrade to Semantic MediaWiki 7.2.0 when possible.
How can I identify potentially affected content?
Review Special:Ask queries for the headers=plain parameter and check whether their mainlabel value can contain user-controlled text. Versions prior to 7.2.0 are affected under those conditions.