CVE-2026-77607: Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Failure mode
sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (requesttype=raw), so the injection was reachable without authentication.
Remediation
- In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a safe <br> variant. - This preserves legitimate line-break separators while blocking markup injection.
Maintenance note
If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.
Other sources
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/semantic-media-wikito a version that resolves this vulnerability.Fixed in 7.2.0 - Upgrade
Upgrade
Semantic MediaWiki (Special:Ask)to a version that resolves this vulnerability.Fixed in 7.2.0 - Configuration
Set/ensure the table renderer does not insert `sep` verbatim into HTML joins. Escape `sep` unless it matches a safe `<br>` variant; keep the whitelist explicit to prevent markup injection. Applies to both standard Special:Ask output and raw request output (`request_type=raw`).
Semantic MediaWiki (Special:Ask table renderer) sep parameter (table cell join separator) = Escaped unless it is a safe <br> variant
Event History
Frequently Asked Questions
Which deployments are affected?
Semantic MediaWiki versions prior to 7.2.0 are affected. The issue applies to uses of Special:Ask table output where the sep parameter can be supplied in a query.
What does an attacker need to exploit this issue?
An attacker needs to cause a user to interact with a Special:Ask query containing a crafted sep parameter. No attacker privileges are required, but user interaction is required.
What should be done if patching is not immediately possible?
The provided information identifies version 7.2.0 as the fix. No alternative mitigation is specified.
How can I determine whether an instance is vulnerable?
Check the installed Semantic MediaWiki version. Versions earlier than 7.2.0 should be treated as affected.