Every CVE Search/ Get API key

CVE-2026-77607

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

6.1 MediumFix available

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.28%Up 0.1 points since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Record
CVE-2026-77607
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-83181 6.1

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Record
EUVD-2026-83181
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7xv3-gf2g-498h 6.1

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Failure mode

sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (request_type=raw), so the injection was reachable without authentication.

Remediation

  • In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a safe <br> variant.
  • This preserves legitimate line-break separators while blocking markup injection.

Maintenance note

If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.

Record
GHSA-7xv3-gf2g-498h
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.1

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Record
CVE-2026-77607
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Record
CVE-2026-77607
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-7xv3-gf2g-498h 6.1

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Failure mode

sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (request_type=raw), so the injection was reachable without authentication.

Remediation

  • In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a safe <br> variant.
  • This preserves legitimate line-break separators while blocking markup injection.

Maintenance note

If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.

Record
GHSA-7xv3-gf2g-498h
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mediawiki/semantic-media-wiki
Packagist
 through 7.1.0
7.2.0
mediawiki/semantic-media-wiki
Packagist
 before 7.2.0, plus listed versions
1.91.9-RC11.9.0.11.9.0.21.9.1
Show 45 moreShow less
1.9.1.11.9.21.9beta12.02.0-RC12.0-RC22.0-RC32.1.02.1.0-RC12.1.12.1.22.1.32.2.02.2.0-RC12.2.12.2.22.2.32.3.02.3.0-RC12.3.12.4.02.4.0-RC12.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.0-rc.12.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.83.0.03.0.0-rc.13.0.0-rc.23.0.13.0.23.1.03.1.0-rc.1
7.2.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77607 is a medium vulnerability (CVSS 6.1) in Semanticmediawiki, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in mediawiki/semantic-media-wiki 7.2.0.

References

This page doesn't list everything

Left out here: 28 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open