Executive brief
Semantic MediaWiki is a popular knowledge management plugin for MediaWiki that adds structured data query capabilities. When generating table results with plain headers, user-supplied label text is rendered without HTML escaping, allowing attackers to inject malicious scripts that execute in the browser of anyone viewing the query results. This could lead to session hijacking, credential theft, or malware distribution.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the TableResultPrinter component of Semantic MediaWiki. When the `headers=plain` parameter is used in Special:Ask queries, the `mainlabel` parameter value is emitted directly into HTML `<th>` table header elements without output encoding. An attacker can craft a query URL containing JavaScript in the mainlabel parameter; the script executes when the page is viewed. The vulnerability requires user interaction (victim must visit the malicious link) and network access. The fix in version 7.2.0 applies HTML context escaping to plain headers before rendering. Affected versions: <= 7.1.0; patched in 7.2.0.
Affected products
- Semantic MediaWiki Semantic MediaWiki <= 7.1.0
Timeline
- 2026-09-18: disclosed: Published to GitHub Advisory Database
- 2026-09-18: patched: Fixed in version 7.2.0