CVE-2026-77607 Overview
CVE-2026-77607 is a stored Cross-Site Scripting (XSS) vulnerability in Semantic MediaWiki, an open-source extension to MediaWiki that stores and queries structured data within wiki pages. Versions prior to 7.2.0 insert the sep (separator) parameter verbatim into HTML cell joins during query result rendering. This allows an attacker to inject arbitrary HTML through the separator value. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Version 7.2.0 remediates the issue by sanitizing the separator before HTML output.
Critical Impact
Attackers can inject HTML or script content via the sep parameter, enabling stored XSS against wiki visitors and potential session theft, credential harvesting, or wiki defacement.
Affected Products
- Semantic MediaWiki versions prior to 7.2.0
- MediaWiki installations using the Semantic MediaWiki extension
- Wiki pages containing inline queries with a user-controlled sep parameter
Discovery Timeline
- 2026-09-18 - CVE-2026-77607 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77607
Vulnerability Analysis
Semantic MediaWiki renders query results using several formats that join cell values with a caller-supplied separator. The sep parameter controls the string placed between joined values in HTML output. In versions prior to 7.2.0, the extension concatenates this value directly into the rendered HTML without escaping. Any HTML markup or script fragment provided as the separator becomes part of the DOM served to viewers.
Exploitation requires user interaction because the injected payload executes when a victim loads a wiki page that renders the malicious query. The scope is changed, meaning injected content can affect resources beyond the vulnerable component itself, such as other MediaWiki interface elements sharing the same origin.
Root Cause
The root cause is missing output encoding on the sep parameter before it is inserted into HTML cell joins. Semantic MediaWiki treated the separator as trusted formatting metadata rather than untrusted user input, bypassing MediaWiki's usual sanitization pipeline for query result rendering.
Attack Vector
An attacker with the ability to edit wiki content or supply query parameters can craft a Semantic MediaWiki inline query where the sep value contains HTML tags or event handlers. When another user views the page, the browser parses the injected markup and executes any embedded script in the wiki's origin. See the GitHub Security Advisory GHSA-7xv3-gf2g-498h for technical details on the vulnerable code path.
No verified public proof-of-concept code is available. The vulnerability manifests in the query result formatter where sep is concatenated into cell join HTML without escaping.
Detection Methods for CVE-2026-77607
Indicators of Compromise
- Wiki page revisions containing Semantic MediaWiki queries with sep= parameters that include <, >, ", or on*= event handler attributes
- Unexpected <script>, <img>, or <iframe> tags appearing in rendered query result tables
- Outbound requests from user browsers to unfamiliar domains after loading wiki pages with inline queries
- MediaWiki extension version reporting Semantic MediaWiki below 7.2.0
Detection Strategies
- Audit page revision histories for {{#ask:}} or {{#show:}} invocations with suspicious sep values using MediaWiki's Special:AllPages or database queries against the text table
- Deploy a Content Security Policy (CSP) in report-only mode to surface script executions originating from injected separators
- Monitor web application firewall logs for query strings containing sep= combined with HTML tag patterns
Monitoring Recommendations
- Log and review all edits to templates that generate Semantic MediaWiki queries, especially those accepting user-controlled parameters
- Alert on new or modified pages that introduce sep values containing angle brackets or JavaScript event handlers
- Track the deployed Semantic MediaWiki version across all wiki instances and flag any below 7.2.0
How to Mitigate CVE-2026-77607
Immediate Actions Required
- Upgrade Semantic MediaWiki to version 7.2.0 or later on all MediaWiki installations
- Review recent page edits for injected HTML in sep parameters and revert malicious revisions
- Rotate session cookies and credentials for administrators who may have viewed exploited pages
- Restrict edit permissions on pages containing inline Semantic MediaWiki queries until patching is complete
Patch Information
The fix is included in Semantic MediaWiki Release 7.2.0, which sanitizes the sep value before insertion into HTML output. Administrators should update via Composer or manual deployment following the official upgrade procedure and clear MediaWiki's parser cache after upgrading to purge poisoned rendered output.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of injected HTML
- Temporarily restrict edit rights for anonymous and low-trust users on wikis running vulnerable versions
- Filter or reject page saves containing Semantic MediaWiki queries with sep values that include HTML metacharacters using an AbuseFilter rule
# Example AbuseFilter expression to block suspicious sep values
added_lines irlike "sep\s*=\s*[^|}]*[<>\"]"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.