CVE-2026-77616: Semantic MediaWiki XSS Vulnerability

CVE-2026-77616 Overview

CVE-2026-77616 is a reflected cross-site scripting (XSS) vulnerability in Semantic MediaWiki, an open-source extension that lets MediaWiki users store and query structured data. The flaw affects versions 7.0.0 through 7.1.0 and lives in the Special:Ask keyset pagination introduced in 7.0.0. Attackers craft a malicious cursor query parameter that decodes into attacker-controlled JSON, causing markup to be reflected as raw HTML in error output. No authentication is required, and exploitation only requires a victim to click a crafted link. The issue is tracked as CWE-79 and is fixed in version 7.2.0.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser on the wiki origin, enabling session theft, account takeover, and wiki content manipulation.

Affected Products

Semantic MediaWiki 7.0.0
Semantic MediaWiki 7.1.0 and prior 7.0.x releases
MediaWiki installations using the Semantic MediaWiki Special:Ask pagination feature

Discovery Timeline

2026-09-18 - CVE-2026-77616 published to the National Vulnerability Database
2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-77616

Vulnerability Analysis

The vulnerability sits in Semantic MediaWiki's keyset pagination handler on the Special:Ask page. The cursor query parameter is a base64url-encoded JSON blob decoded by CursorEncoder. Because the token is unsigned, its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's sort= and order= values, QueryCreator::applyCursorIfRequested() builds an error message by interpolating the attacker-supplied sort_prop and sort_order fields into a raw string via Query::addErrors(). Standard Semantic MediaWiki errors use message keys that pass through sanitization, but this raw string bypasses the message layer. ProcessingErrorMsgHandler::normalizeAndDecodeMessages() passes non-key, non-encoded strings through unchanged. Downstream, ErrorWidget::queryError() hands the assembled errors to Html::errorBox(), which emits its first argument as raw HTML.

Root Cause

Two compounding defects create the vulnerability. First, the cursor token is unsigned and unauthenticated, so the server treats attacker-controlled JSON as trusted state. Second, the error construction path concatenates untrusted values into a raw string that skips the message sanitization pipeline before reaching an HTML sink. This is a classic output encoding failure classified as CWE-79.

Attack Vector

An attacker crafts a base64url-encoded JSON cursor containing HTML or JavaScript payloads in sort_prop or sort_order. The attacker embeds the malicious cursor in a Special:Ask URL and delivers it through phishing, forums, chat, or embedded links on other wiki pages. When a victim visits the link, the wiki reflects the payload into the error box and executes script in the victim's browser under the wiki's origin. Successful exploitation can steal session cookies, perform CSRF-protected actions as the victim, edit wiki content, or pivot to administrator accounts.

A sanitized description of the exploit flow: the attacker builds a JSON object whose sort_prop field contains an <img onerror> or <script> payload, base64url-encodes it, and appends it as ?cursor=... to any Special:Ask URL on a vulnerable wiki. Refer to the GitHub Security Advisory GHSA-cx86-7xwp-w9wf for full technical details.

Detection Methods for CVE-2026-77616

Indicators of Compromise

HTTP requests to Special:Ask containing a cursor query parameter whose base64url-decoded JSON includes HTML tags, angle brackets, or JavaScript keywords in sort_prop or sort_order
Web server or reverse proxy logs showing Special:Ask requests with unusually long or encoded cursor values from external referrers
Browser console errors or unexpected script execution on wiki pages rendered from Special:Ask responses

Detection Strategies

Decode the cursor parameter server-side during log review and flag values whose JSON fields contain <, >, ", javascript:, or on*= event handler patterns
Deploy Web Application Firewall (WAF) rules that inspect base64url-encoded query parameters on Special:Ask endpoints and block payloads containing HTML markup
Correlate suspicious Special:Ask requests with subsequent authenticated actions from the same session to identify successful account hijacking

Monitoring Recommendations

Ingest MediaWiki access logs and reverse proxy logs into a centralized analytics platform and alert on anomalous cursor parameter entropy or length
Monitor Content Security Policy (CSP) violation reports from wiki users, which will surface reflected script execution attempts
Track outbound requests from wiki user sessions to unexpected external hosts, which may indicate data exfiltration from a successful XSS

How to Mitigate CVE-2026-77616

Immediate Actions Required

Upgrade Semantic MediaWiki to version 7.2.0 or later, which contains the official fix
Audit Special:Ask request logs for the presence of malicious cursor payloads dating back to the deployment of version 7.0.0
Invalidate active user sessions after upgrading to reduce risk from any session tokens already stolen via exploitation
Notify wiki users to reset passwords if suspicious cursor activity is found in historical logs

Patch Information

The maintainers released the fix in Semantic MediaWiki 7.2.0. The patch corrects the error construction path so that attacker-controlled sort_prop and sort_order values are properly encoded before reaching Html::errorBox(). Administrators should review the GitHub Security Advisory GHSA-cx86-7xwp-w9wf for complete remediation guidance.

Workarounds

If immediate upgrade is not possible, deploy a WAF rule that rejects requests to Special:Ask containing a cursor parameter until the patched version can be installed
Enforce a strict Content Security Policy that disallows inline scripts and unsafe event handlers on wiki pages to reduce the impact of reflected XSS
Restrict access to Special:Ask to authenticated users via MediaWiki permissions to shrink the pool of potential victims