CVE-2026-77606
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77606- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-83171
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
- Record
EUVD-2026-83171- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3jp5-3h47-28qf
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Failure mode
When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.
Remediation
TableResultPrinternow applies output-context escaping before passing plain headers to the table renderer.- The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
- Record
GHSA-3jp5-3h47-28qf- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77606- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77606- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-3jp5-3h47-28qf
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Failure mode
When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.
Remediation
TableResultPrinternow applies output-context escaping before passing plain headers to the table renderer.- The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
- Record
GHSA-3jp5-3h47-28qf- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/semantic-media-wikiPackagist |
through 7.1.0 | 7.2.0 |
mediawiki/semantic-media-wikiPackagist |
before 7.2.0, plus listed versions 1.91.9-RC11.9.0.11.9.0.21.9.1 Show 45 moreShow less1.9.1.11.9.21.9beta12.02.0-RC12.0-RC22.0-RC32.1.02.1.0-RC12.1.12.1.22.1.32.2.02.2.0-RC12.2.12.2.22.2.32.3.02.3.0-RC12.3.12.4.02.4.0-RC12.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.0-rc.12.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.83.0.03.0.0-rc.13.0.0-rc.23.0.13.0.23.1.03.1.0-rc.1 |
7.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-77606 is a medium vulnerability (CVSS 6.1) in Semanticmediawiki, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in mediawiki/semantic-media-wiki 7.2.0.
References
github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-3jp5-3h47-28qf
nvd.nist.gov/vuln/detail/CVE-2026-77606
Left out here: 28 versions. The JSON record has them.