Semantic MediaWiki CVE-2026-116875

Exploitation requires the public Special:Ask special page with the remote request 'send-response' feature, which is enabled by default (extension.json:1765), so default installations are affected. The attacker must supply a crafted separator parameter (sep, propsep, valuesep, delim, or separator) together with request_type=raw for the list and category printers or request_type=special_page for the DSV and CSV printers. The list-printer path additionally needs at least two pages carrying semantic properties to satisfy the count>0 gate. The primary limiting factor is required victim interaction (UI:P): a user must click the attacker-supplied link, and the practical blast radius depends on that user's privilege level. No attacker authentication is required (PR:N). The interim mitigation per the advisory is removing 'send-response' from RemoteReqFeatures, which disables legitimate remote query functionality; the vendor fix is upgrading to the patched release.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, score 5.3 Medium) describes a reflected XSS that is network-reachable and low-complexity against default installations, but exploitation is gated on victim interaction (UI:P) - the attacker must persuade a user to click a crafted link, so it is not self-propagating or automatable. Impact is limited (VC:L/VI:L): script execution in the wiki origin enabling session cookie and CSRF-token theft, with the real-world severity scaling to the privilege of whoever clicks (administrative actions if an admin is lured). No EPSS score and no KEV listing were provided, so there is no confirmed active-exploitation signal; the vuln.today Decision label is 'this_month', consistent with a medium-severity, interaction-dependent web flaw rather than act_now/emergency. A detailed public PoC (exact request and expected response) is published in the GHSA advisory, which raises practical exploitability above a purely theoretical finding. Signals are broadly consistent (medium CVSS, no KEV/EPSS, this_month priority) with one data conflict noted below regarding fix status.

An attacker crafts a Special:Ask URL with a malicious separator parameter (e.g. p[sep]=<img src=x onerror=...>) using request_type=raw and sends it to a wiki user via email or chat. When the victim - ideally a logged-in administrator - clicks the link, the browser receives the unescaped response served as text/html and executes the injected JavaScript in the wiki's origin, stealing the session cookie or CSRF token. A full working PoC request and expected response are published in the GHSA advisory, so the trigger is concretely documented rather than inferred.