Summary
Semantic MediaWiki has a query debug output XSS (DebugFormatter)
Query debug output XSS
Failure mode
Semantic MediaWiki's query debug output (format=debug, or the debug request parameter on Special:Ask) is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping:
buildHTML()echoes the re-serialized ASK query string escaping only[;<,>,",'pass through.prettifySQL()returns the generated SQL verbatim. Query value literals are inlined into the SQL through the database layer's quoting (SQL-escaping only, no HTML encoding), so markup in a value survives.prettifyExplain()echoesEXPLAINoutput; on PostgreSQL the plan text contains theWHEREliterals.
On Special:Ask the resulting string is concatenated into the page and sent through OutputPage::addHTML, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices.
This is a reflected XSS: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text/blob-typed property (whose value is re-serialized verbatim); the predefined _txt properties (Text, etc.) that ship on every install satisfy this, so no attacker-created content is needed. Example request:
Special:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1
Scope
The prettifySPARQL() sink already encodes < and > and is not affected. The same debug path is also reachable through inline {{#ask:...|format=debug}}, but that output returns into parser context and is sanitized there; the reflected Special:Ask path is the exposed sink.
Relationship to GHSA-5jhc-3j2f-52rv
This issue was identified while splitting the consolidated report GHSA-5jhc-3j2f-52rv into per-vulnerability advisories. It is distinct from the four items in that report (plain table header, sep, SearchByProperty value, open redirect) and from Special:Ask form-input XSS (which is escaped separately).
Impact
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2026-77610 has a CVSS score of 6.1 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.2.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Apply output-context escaping at the
DebugFormatterboundary. ThebuildHTML()contract already assumes its inputs are HTML-safe, but its callers do not honour that; escape each entry value on emission, and the SQL andEXPLAINstrings before they are wrapped. - Escaping only the query-string echo is insufficient:
prettifySQL()and the "Auxilliary Tables" executed-query text carry the same attacker-controlled literals.
Frequently Asked Questions
- What is CVE-2026-77610? CVE-2026-77610 is a medium-severity cross-site scripting (XSS) vulnerability in mediawiki/semantic-media-wiki (composer), affecting versions <= 7.1.0. It is fixed in 7.2.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2026-77610? CVE-2026-77610 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of mediawiki/semantic-media-wiki are affected by CVE-2026-77610? mediawiki/semantic-media-wiki (composer) versions <= 7.1.0 is affected.
- Is there a fix for CVE-2026-77610? Yes. CVE-2026-77610 is fixed in 7.2.0. Upgrade to this version or later.
- Is CVE-2026-77610 exploitable, and should I be worried? Whether CVE-2026-77610 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-77610 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-77610? Upgrade
mediawiki/semantic-media-wikito 7.2.0 or later.