GHSA-59xw-qv23-j3rc: XSS
Failure mode
The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.
Remediation
- The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML.
Maintenance note
Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/semantic-media-wikito a version that resolves this vulnerability.Fixed in 7.2.0 - Configuration
Apply context-aware output encoding/escaping to any attacker-influenced form `value` and any derived error messages before rendering them into HTML or reflecting them back into the input field, including the error messaging paths.
Web application output rendering (HTML) context-aware output encoding = Enable output-context encoding for user-controlled `value` reflected into HTML and error messaging paths; ensure derived/validation error messages are escaped before HTML rendering
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker needs to cause a target to interact with a page or form flow that renders an attacker-controlled value or validation-derived error message. The attack requires user interaction, but no attacker privileges are indicated by the supplied vector.
Which output paths need review if an immediate update is not possible?
Review form fields that reflect submitted values back into HTML and any rendered validation or error messages derived from those values. Apply context-appropriate HTML output encoding to both paths; validation messages must not be treated as trusted.
How can I determine whether a deployment is affected?
Test whether submitted form values or validation-triggering input are reflected into rendered HTML without escaping. Check both the input field's redisplayed value and any error message shown after validation fails.