GHSA-7xv3-gf2g-498h: XSS
Failure mode
sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (requesttype=raw), so the injection was reachable without authentication.
Remediation
- In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a safe <br> variant. - This preserves legitimate line-break separators while blocking markup injection.
Maintenance note
If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/semantic-media-wikito a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
Does exploitation require an authenticated MediaWiki account?
No. The injection is reachable without authentication through both the standard Special:Ask render and raw request output using request_type=raw. The CVSS vector indicates user interaction is required.
What input must an attacker control?
The attacker must be able to supply a separator value through the sep parameter. Before remediation, that value was inserted verbatim into the HTML used to join table-cell values.
Which output paths are affected?
The same unsanitized table HTML was produced for the normal Special:Ask rendering and raw request output. The remediation also applies escaping in non-wiki HTML, raw-request, and file output modes.
What separator values remain permitted after remediation?
The sep value is escaped unless it is a safe variant of a br element. This preserves line-break separators while preventing arbitrary HTML markup from being inserted.