Executive brief
Semantic MediaWiki, an extension that adds structured data capabilities to MediaWiki, contains a reflected cross-site scripting (XSS) vulnerability in its query debug output feature. An attacker can inject malicious scripts into search queries that will be reflected back in the page without proper sanitization, allowing the script to execute in a user's browser when they view the debug output. This can lead to session hijacking, data theft, or other attacks requiring no special permissions or user interaction.
Technical details
The vulnerability exists in the `SMW\Query\DebugFormatter` class, which assembles query debug output (via `format=debug` parameter or `Special:Ask` page) and emits it as raw HTML without proper output encoding. The `buildHTML()` method re-serializes ASK query strings but only escapes `[` characters, allowing `<`, `>`, `"`, and `'` to pass through. Similarly, `prettifySQL()` inlines query value literals through SQL-escaping only (no HTML encoding), and `prettifyExplain()` echoes database `EXPLAIN` output containing unencoded WHERE clause values. The vulnerability is a reflected XSS: attacker-controlled query input (e.g., `[[Text::<script>alert()</script>]]`) is reflected in the response via `OutputPage::addHTML()` without sanitization. No special rights are required; exploitation works with predefined text-property fields present on every install. The fix requires applying HTML output-context escaping at the `DebugFormatter` boundary for all three sinks: query string, SQL, and EXPLAIN output.
Affected products
- Semantic MediaWiki Semantic MediaWiki <UNKNOWN>
Timeline
- 2026-09-18: disclosed