CVE-2026-77606 Overview
CVE-2026-77606 is a stored cross-site scripting (XSS) vulnerability in Semantic MediaWiki, an open-source extension that adds structured data storage and querying to MediaWiki installations. Versions prior to 7.2.0 emit table header text into <th> elements through a raw HTML path when the headers=plain option is used. Attacker-controlled mainlabel content becomes executable HTML in the rendered page. The maintainers fixed the flaw in version 7.2.0. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated users who can author wiki queries can inject executable HTML or JavaScript that runs in the browser of any visitor who views the affected page.
Affected Products
- Semantic MediaWiki versions prior to 7.2.0
- MediaWiki installations using the Semantic MediaWiki extension with query output configured for headers=plain
- Wiki pages rendering user-supplied mainlabel values through affected query templates
Discovery Timeline
- 2026-09-18 - CVE-2026-77606 published to the National Vulnerability Database
- 2026-09-24 - Last updated in the NVD database
Technical Details for CVE-2026-77606
Vulnerability Analysis
Semantic MediaWiki renders query results as HTML tables. When the query output uses the headers=plain parameter, the extension writes the header cell text into <th> elements through a raw HTML emission path. That path does not apply HTML entity encoding to user-supplied values.
The mainlabel parameter controls the label displayed for the main column in a query result. Because a wiki editor can supply arbitrary strings for mainlabel, the raw HTML path lets that content reach the DOM without neutralization. Any HTML tags or event handlers embedded in the label execute in the context of the rendered page.
The issue affects browsers of any user who views a page containing an attacker-crafted query. Execution occurs in the origin of the wiki, giving the injected script access to the victim's session cookies, CSRF tokens, and page content.
Root Cause
The root cause is missing output encoding on a code path that treats header text as pre-sanitized HTML. Semantic MediaWiki's headers=plain mode bypasses the standard sanitization used for other header modes and writes mainlabel content directly into the <th> element.
Attack Vector
Exploitation requires an attacker to place a crafted Semantic MediaWiki query on a wiki page, then wait for another user to load that page. The payload lives in the mainlabel argument of an affected query configured with headers=plain. User interaction is required to trigger the stored payload, and the impact crosses the security scope of the wiki application into the victim's browser session.
No working exploit code is publicly indexed at this time. See the GitHub Security Advisory GHSA-3jp5-3h47-28qf for the maintainers' technical description.
Detection Methods for CVE-2026-77606
Indicators of Compromise
- Wiki page revisions that introduce Semantic MediaWiki queries containing headers=plain together with a mainlabel value that includes <, >, ", ', or on* event-handler substrings
- Rendered HTML on wiki pages where <th> elements contain <script>, <img>, <svg>, or inline event handlers such as onerror and onload
- Unexpected outbound requests from browsers of authenticated wiki users to attacker-controlled domains shortly after loading query pages
Detection Strategies
- Audit page revision histories for edits that add or modify {{#ask:}} or {{#show:}} queries containing the headers=plain parameter with a non-trivial mainlabel
- Scan the rendered HTML of query-heavy pages for markup inside <th> elements that should never appear in normal header labels
- Correlate MediaWiki edit logs with subsequent Content Security Policy violation reports if CSP is enforced
Monitoring Recommendations
- Enable and monitor MediaWiki AbuseFilter rules to flag edits containing suspicious characters within Semantic MediaWiki query parameters
- Forward MediaWiki page-edit logs and web server access logs to a centralized log platform for retrospective hunting against the indicators above
- Track browser telemetry or CSP report endpoints for script-src violations originating from wiki pages
How to Mitigate CVE-2026-77606
Immediate Actions Required
- Upgrade Semantic MediaWiki to version 7.2.0 or later on all MediaWiki installations that use the extension
- Identify and review recent wiki edits that introduced queries using headers=plain, and revert or sanitize any that contain HTML metacharacters in mainlabel
- Restrict edit permissions on wiki namespaces where untrusted users can author Semantic MediaWiki queries until the patch is applied
Patch Information
The Semantic MediaWiki maintainers released version 7.2.0, which routes headers=plain header text through the standard HTML-escaping path. Upgrade details are available in the Semantic MediaWiki 7.2.0 release notes and the GitHub Security Advisory GHSA-3jp5-3h47-28qf.
Workarounds
- Avoid the headers=plain output option in Semantic MediaWiki queries until the extension is upgraded
- Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script origins to reduce the impact of injected HTML
- Limit wiki edit rights to trusted accounts and require review of edits that add or modify query templates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.