Is CVE-2026-77606 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77606 being exploited in the wild.

How severe is CVE-2026-77606?

Medium severity, with a CVSS score of 6.1, published 18 September 2026.

Which products and versions are affected?

mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <= 7.1.0.

Is there a fix for CVE-2026-77606?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77606 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77606?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77606: Semantic MediaWiki reflected XSS in Special:Ask plain table headers

Q: Is there a fix for CVE-2026-77606?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77606 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77606?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77606 · Severity: medium · CVSS 6.1 · Published 2026-09-18

Semantic MediaWiki is a popular knowledge management plugin for MediaWiki that adds structured data query capabilities. When generating table results with plain headers, user-supplied label text is rendered without HTML escaping, allowing attackers to inject malicious scripts that execute in the browser of anyone viewing the query results. This could lead to session hijacking, credential theft, or malware distribution.

Technologies: mediawiki/semantic-media-wiki (Packagist), Semantic MediaWiki. Vendors: Packagist, Semantic MediaWiki.

Quick answers

Is CVE-2026-77606 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77606 being exploited in the wild.
How severe is CVE-2026-77606?: Medium severity, with a CVSS score of 6.1, published 18 September 2026.
Which products and versions are affected?: mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <= 7.1.0.
Is there a fix for CVE-2026-77606?: Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77606 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77606?: Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later
```
composer require mediawiki/semantic-media-wiki:^7.2.0
```

Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the TableResultPrinter component of Semantic MediaWiki. When the `headers=plain` parameter is used in Special:Ask queries, the `mainlabel` parameter value is emitted directly into HTML `<th>` table header elements without output encoding. An attacker can craft a query URL containing JavaScript in the mainlabel parameter; the script executes when the page is viewed. The vulnerability requires user interaction (victim must visit the malicious link) and network access. The fix in version 7.2.0 applies HTML context escaping to plain headers before rendering. Affected versions: <= 7.1.0; patched in 7.2.0.

Affected products

Semantic MediaWiki Semantic MediaWiki <= 7.1.0

Identifiers

CVE-2026-77606
GHSA-3jp5-3h47-28qf

Timeline

2026-09-18: disclosed: Published to GitHub Advisory Database
2026-09-18: patched: Fixed in version 7.2.0

References

https://api.github.com/users/krabina

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.