Semantic MediaWiki CVE-2026-77607

Requires the Semantic MediaWiki extension (<=7.1.0) installed on a MediaWiki instance and use of the Special:Ask table output with an attacker-controlled sep (separator) parameter. Exploitation is unauthenticated because the same unsanitised table HTML is generated for the raw request output (request_type=raw), but it is LIMITED by UI:R - a victim must be induced to load the crafted query URL for the reflected payload to fire in their browser. Only markup-bearing separator values are dangerous; legitimate <br> variants remain whitelisted after the fix.

This is a genuine but moderate-severity issue, correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) for a reflected XSS. The GitHub advisory (GHSA-7xv3-gf2g-498h) confirms the sep separator value is echoed verbatim into the HTML that joins Special:Ask table cells, and - critically - the same unsanitised HTML is produced for the raw request output (request_type=raw), making injection reachable without authentication (consistent with PR:N). No EPSS score, no CISA KEV listing, and no standalone proof-of-concept exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis (though the advisory describes the injection mechanism in enough detail to reconstruct it). Realistic risk is bounded by the UI:R requirement - a victim must load an attacker-crafted URL/parameter - placing this in the 'classic reflected XSS, patch promptly but not emergency' tier rather than a mass-exploitation priority. The S:C (scope change) and C:L/I:L reflect that injected script executes in the victim's authenticated wiki session, enabling session/credential theft and UI defacement within that trusted origin. No conflicting signals: network vector, low complexity, and unauth reachability are all corroborated by the advisory text.

An attacker crafts a Special:Ask query URL (or a raw request via request_type=raw) whose sep separator parameter contains HTML/JavaScript markup, then lures a wiki user into loading it. The unescaped separator is reflected into the table cell-join HTML and executes in the victim's browser under the wiki's trusted origin, allowing session cookie theft or actions as the victim. No authentication is required to trigger the reflected payload, and the advisory documents the injection point though no packaged exploit is provided.