GHSA-3jp5-3h47-28qf: XSS
Failure mode
When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.
Remediation
- TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/semantic-media-wikito a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to HTML table output using headers=plain. Safe rendering modes are unaffected by this fix.
What must an attacker be able to control?
An attacker needs to supply user-controlled mainlabel content that is rendered as a plain table header. Exploitation also requires a user to view the resulting rendered HTML.
How can I identify potentially affected output?
Review Semantic MediaWiki table output that uses headers=plain and determine whether its mainlabel value can contain untrusted content. Those outputs are the relevant candidates for this issue.
What changes in the remediation?
The TableResultPrinter applies output-context escaping to plain headers before they reach the table renderer. This prevents mainlabel display data from being emitted through the raw HTML header path.