Semantic MediaWiki CVE-2026-77616

Requires that the wiki runs Semantic MediaWiki 7.0.0 through 7.1.0, where Special:Ask exposes the keyset-pagination cursor parameter (introduced in 7.0.0). No authentication or special permission is needed - any anonymous user can trigger it. Exploitation requires victim user interaction: the target must open an attacker-crafted link (e.g. Special:Ask?q=...&p[cursor]=<forged token> whose decoded JSON is {"v":1,"sort_prop":"<script>...</script>"}), and the cursor's sort anchor must mismatch the request's sort=/order= to reach the error path. Exploitation is aided by the absence of a Content-Security-Policy on responses, which allows inline script to run; a wiki enforcing a restrictive CSP would blunt inline-script payloads. Upgrading to 7.2.0 removes the vulnerability.

This is a genuine but moderate-severity reflected XSS (CWE-79). The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) is consistent with a classic reflected XSS: network-reachable, low complexity, no privileges, but requiring victim interaction (clicking a crafted link), with a scope change (script runs in the wiki origin, a different security context than the vulnerable server component) and limited direct confidentiality/integrity impact. No EPSS score, KEV entry, or SSVC decision data was provided in the input, so exploitation-probability and automatability cannot be quantified. However, the GHSA advisory explicitly states the payload was 'Confirmed executing in a browser' and that responses carry no Content-Security-Policy, so inline script is not blocked - this constitutes publicly documented, working exploit detail even though no standalone weaponized exploit tool is referenced. The realistic risk profile is targeted, not wormable: exploitation needs a victim to follow an attacker-crafted link, which caps mass-automation potential. This is a real fix-worthy issue for exposed wikis but not a drop-everything critical; the 6.1 rating fairly reflects the UI:R gating. Key missing signals: no EPSS, no KEV, no independent confirmation beyond the vendor's own advisory.

An attacker crafts a link to Special:Ask containing a forged base64url cursor token whose decoded JSON sets sort_prop (or sort_order) to an HTML/script payload, then lures a victim (via phishing, forum post, or wiki edit) into clicking it. Because the cursor is unsigned and its sort anchor deliberately mismatches the request's sort=/order=, SMW builds a raw error string that bypasses message-layer sanitization and is emitted as raw HTML by Html::errorBox(), executing the script in the victim's browser on the wiki origin. The vendor advisory confirms the payload was observed executing in a browser and notes the absence of any Content-Security-Policy to block inline script.