Semantic MediaWiki EUVD-2026-83171

Exploitation requires the Special:Ask result printer to be invoked with headers=plain and attacker-controlled mainlabel content, which is reflected into the table header (<th>) via the raw HTML path - this is the specific feature combination that triggers the flaw. Because it is reflected, the attacker must deliver a crafted URL and a victim must open it (UI:R), so successful exploitation depends on social engineering and on Special:Ask being reachable to the targeted user. Safe rendering modes (non-plain headers) are unaffected, and the flaw is fixed in 7.2.0; deployments on <= 7.1.0 that expose Special:Ask queries are the realistic exposure. No authentication is required to craft the malicious link, but impact scales with the privilege of the victim whose session runs the script.

This is a reflected cross-site scripting flaw (CWE-79) in Semantic MediaWiki's Special:Ask when headers=plain, where user-controlled mainlabel content is emitted into a <th> via a raw HTML path. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) is consistent with a reflected XSS delivered through a crafted URL: network reachable, low complexity, no privileges, but requiring victim interaction, with a scope change and limited confidentiality/integrity impact. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code provided in the intelligence - so exploitation status is 'no public exploit identified at time of analysis.' The GHSA advisory (GHSA-3jp5-3h47-28qf) does describe the exact failure mode and sink, which lowers the bar for an attacker to reconstruct a payload, but that is not the same as a released PoC. Net: this is a genuine but medium-priority issue - real (vendor-confirmed, patched) yet gated on user interaction and yielding only session-context script execution rather than direct server compromise. No key signals conflict; the main gap is the absence of exploitation-probability data (EPSS/KEV/PoC), so prioritization should lean on deployment exposure of public Special:Ask pages rather than telemetry.

An attacker crafts a Special:Ask query URL where the mainlabel parameter contains malicious HTML/JavaScript and the printer is set to headers=plain, then lures an authenticated wiki user (e.g., an admin) into clicking it. When the results table renders, the unescaped header text executes in the victim's browser session, enabling session/cookie theft or actions in the victim's context. No public exploit code is provided, though the advisory documents the vulnerable sink precisely.