CVE-2026-77610: Semantic MediaWiki XSS Vulnerability

CVE-2026-77610 Overview

CVE-2026-77610 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Semantic MediaWiki, an open-source extension that lets users store and query structured data within MediaWiki pages. Versions prior to 7.2.0 emit query debug output as raw HTML without output-context encoding. Attacker-controlled query input passes through SMW\Query\DebugFormatter and is concatenated into the response via OutputPage::addHTML, bypassing the MediaWiki parser and Sanitizer. No authentication is required, and predefined _txt properties such as Text that ship on every installation satisfy the exploitation preconditions.

Critical Impact
An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in a victim's browser session against any vulnerable Semantic MediaWiki instance.

Affected Products

Semantic MediaWiki versions prior to 7.2.0
Installations exposing Special:Ask with debug output enabled
Any Semantic MediaWiki instance shipping default _txt properties (Text, etc.)

Discovery Timeline

2026-09-18 - CVE-2026-77610 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77610

Vulnerability Analysis

The vulnerability resides in Semantic MediaWiki's query debug output pipeline. When a request specifies format=debug or supplies the debug request parameter on Special:Ask, the SMW\Query\DebugFormatter class assembles diagnostic HTML from the incoming query. Several sinks within this formatter emit attacker-controlled query fragments directly into the response without applying context-appropriate encoding.

The assembled string is concatenated into the page and sent through OutputPage::addHTML. This method bypasses the MediaWiki parser and the built-in Sanitizer, both of which normally strip or neutralize dangerous markup. Because the debug output reflects the request in the same response, the flaw is a classic reflected XSS suitable for social-engineered link delivery.

Root Cause

The root cause is missing output-context encoding in SMW\Query\DebugFormatter. Query conditions targeting text or blob-typed properties are re-serialized verbatim into the debug HTML. The predefined _txt properties such as Text satisfy this condition on every default install, so an attacker does not need to create wiki content first.

Attack Vector

An attacker crafts a URL to Special:Ask containing a malicious query condition and debug parameter. The victim clicks the link while authenticated to a vulnerable wiki. The server reflects the payload into the response, and the browser executes the injected JavaScript under the wiki's origin. Impact includes session token theft, action forgery, and defacement of the rendered page.

No account is required to trigger the flaw, and user interaction is limited to visiting the crafted URL. See the GitHub Security Advisory GHSA-q5fm-9mx6-44f4 for the technical details.

Detection Methods for CVE-2026-77610

Indicators of Compromise

Web server access logs containing requests to Special:Ask with the debug parameter or format=debug query string.
Query strings referencing _txt properties such as Text combined with HTML tags, <script>, on*= event handlers, or javascript: URIs.
URL-encoded payload fragments such as %3Cscript%3E, %3Cimg, or %22onerror%3D in Semantic MediaWiki request logs.

Detection Strategies

Inspect HTTP request logs for Special:Ask traffic containing debug flags and pattern-match for HTML metacharacters in query conditions.
Deploy a Web Application Firewall (WAF) rule that flags XSS payload signatures in requests targeting Semantic MediaWiki endpoints.
Correlate outbound browser traffic from wiki users with unexpected cross-origin requests that could indicate session token exfiltration.

Monitoring Recommendations

Enable verbose access logging for Special:Ask and archive logs for retrospective analysis.
Monitor for spikes in debug=-flagged requests, which are uncommon in normal editorial workflows.
Alert on Content Security Policy (CSP) violation reports originating from the wiki domain.

How to Mitigate CVE-2026-77610

Immediate Actions Required

Upgrade Semantic MediaWiki to version 7.2.0 or later without delay.
Audit reverse proxies and CDN caches for stored copies of debug responses that may embed reflected payloads.
Notify wiki users to avoid clicking untrusted links pointing to Special:Ask until the upgrade is complete.

Patch Information

Semantic MediaWiki version 7.2.0 remediates the flaw by applying proper output encoding in SMW\Query\DebugFormatter. Refer to the Semantic MediaWiki 7.2.0 release notes for upgrade guidance and to the GitHub Security Advisory GHSA-q5fm-9mx6-44f4 for the vendor's technical disclosure.

Workarounds

Block or restrict access to Special:Ask requests containing the debug parameter at the reverse proxy or WAF layer.
Enforce a strict Content Security Policy that disallows inline script execution on wiki origins.
Restrict anonymous access to Special:Ask until the patched release is deployed.

bash

# Example nginx rule to block debug-mode Ask requests until patched
location ~* /wiki/Special:Ask {
    if ($arg_debug) { return 403; }
    if ($args ~* "format=debug") { return 403; }
}