GHSA-3v2c-r7rx-frc8: SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

Published Oct 27, 2026

Updated

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using requesttype=raw or requesttype=specialpage to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue and what interaction is required?

An unauthenticated attacker can craft a Special:Ask URL containing malicious separator parameter values. A victim must open the crafted link for JavaScript to execute in the wiki's origin.

Which query modes and result printers are affected?

The issue is reachable when Special:Ask is used with request_type=raw or request_type=special_page. The affected result printers are list, category, DSV, and CSV, using the sep, propsep, valuesep, delim, or separator parameters.

What could an attacker do after successful exploitation?

Script executing in the wiki's origin may steal the victim's session or CSRF tokens. The impact depends on the privileges of the user who opens the malicious link.

Which versions are affected?

SemanticMediaWiki versions from 3.0.0 before 7.3.1 are affected.

GHSA-3v2c-r7rx-frc8: SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

Event History

Frequently Asked Questions

Who can exploit this issue and what interaction is required?

Which query modes and result printers are affected?

What could an attacker do after successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue and what interaction is required?

Which query modes and result printers are affected?

What could an attacker do after successful exploitation?

Which versions are affected?