GitHub Advisoryadvisory · Packagist

GHSA-59xw-qv23-j3rc Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

MEDIUM Published 2026-09-18 Modified 2026-09-18 Official page ↗
Aliases
CVE-2026-77608
Ecosystem
Packagist
Packages
mediawiki/semantic-media-wiki
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-09-18

Affected packages

• Packagist mediawiki/semantic-media-wiki: < 7.2.0 → fixed in 7.2.0

Description

Failure mode The `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation • The form value is escaped before it is placed back into the input field. • Derived error messages are also escaped before being rendered into HTML. Maintenance note Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.

Related

Alias · CVE (1)

  • CVE-2026-77608 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References