CVE-2026-77608 Overview
CVE-2026-77608 is a reflected cross-site scripting (XSS) vulnerability in Semantic MediaWiki, an open-source extension to MediaWiki that stores and queries structured data within wiki pages. The flaw exists in versions prior to 7.2.0. The value parameter is reflected into rendered output and error messaging paths without sufficient output-context encoding. An attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when the link is visited. The issue is classified under [CWE-79]. Version 7.2.0 addresses the vulnerability.
Critical Impact
Attackers can execute arbitrary script in the context of the wiki, enabling session hijacking, credential theft, or defacement when users click a crafted link.
Affected Products
- Semantic MediaWiki versions prior to 7.2.0
- MediaWiki installations running the Semantic MediaWiki extension
- Wiki deployments exposing the affected value parameter to unauthenticated users
Discovery Timeline
- 2026-09-18 - CVE-2026-77608 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-77608
Vulnerability Analysis
The vulnerability is a reflected XSS issue in Semantic MediaWiki's handling of the value parameter. User-supplied input passed to the value parameter is echoed back into rendered HTML output and error messaging without proper output-context encoding. Because the reflection occurs in an HTML context, an attacker can inject script tags or event handlers that execute in the browser of any user who loads the crafted URL.
Exploitation requires user interaction, typically clicking a malicious link. The scope changes because injected script runs within the wiki's origin, allowing access to authenticated session data belonging to the victim. Successful exploitation can lead to account takeover of privileged wiki users, silent modification of wiki content, or delivery of secondary payloads to visitors.
Root Cause
The root cause is missing or insufficient output encoding on the value parameter along rendering and error-message code paths. The application trusts input that should be treated as untrusted data and inserts it into HTML output without context-appropriate escaping such as HTML entity encoding for element content or attribute encoding for attribute values.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker constructs a URL containing a payload in the value parameter and delivers it through phishing, forum posts, or third-party sites. When the victim loads the URL, the wiki reflects the payload into the response and the browser executes it. No authentication is required to craft or deliver the payload. Details are described in the GitHub Security Advisory GHSA-59xw-qv23-j3rc.
Detection Methods for CVE-2026-77608
Indicators of Compromise
- Web server access logs showing requests with <script>, onerror=, onload=, or URL-encoded script payloads in the value query parameter
- Unusual outbound requests from user browsers to attacker-controlled domains following a wiki page load
- Unexpected changes to wiki content or user account settings made by privileged accounts after clicking external links
Detection Strategies
- Inspect HTTP request logs for anomalous or encoded characters in the value parameter targeting Semantic MediaWiki endpoints
- Deploy a web application firewall (WAF) rule that flags reflected XSS patterns in query strings against wiki hostnames
- Correlate suspicious referrers and short-lived sessions on privileged wiki accounts with subsequent content edits
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture script violations originating from the wiki origin
- Monitor MediaWiki audit logs for privilege changes, permission grants, or bulk edits following visits to externally sourced URLs
- Alert on outbound traffic from wiki editor workstations to newly registered or low-reputation domains
How to Mitigate CVE-2026-77608
Immediate Actions Required
- Upgrade Semantic MediaWiki to version 7.2.0 or later, published in the SemanticMediaWiki 7.2.0 release
- Review recent web server logs for suspicious value parameter payloads and investigate impacted user sessions
- Force session invalidation for administrator and editor accounts if exploitation is suspected
Patch Information
The maintainers fixed the issue in Semantic MediaWiki 7.2.0 by applying output-context encoding on the value parameter across rendering and error-message paths. Administrators should follow the standard MediaWiki extension upgrade procedure and verify the installed version reports 7.2.0 or newer. See the GitHub Security Advisory GHSA-59xw-qv23-j3rc for advisory details.
Workarounds
- Deploy a WAF rule blocking script-like content in the value query parameter until the upgrade is applied
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Restrict wiki access to authenticated users where possible to reduce exposure to unauthenticated visitors following malicious links
# Configuration example: enforce CSP header in the web server as a mitigation
# Apache httpd example
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.