Is CVE-2026-77610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77610 being exploited in the wild.

How severe is CVE-2026-77610?

Medium severity, with a CVSS score of 6.1, published 18 September 2026.

Is there a fix for CVE-2026-77610?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77610 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77610?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77610: Semantic MediaWiki query debug output XSS in DebugFormatter

CVE-2026-77610 · Severity: medium · CVSS 6.1 · Published 2026-09-18

Semantic MediaWiki, an extension that adds structured data capabilities to MediaWiki, contains a reflected cross-site scripting (XSS) vulnerability in its query debug output feature. An attacker can inject malicious scripts into search queries that will be reflected back in the page without proper sanitization, allowing the script to execute in a user's browser when they view the debug output. This can lead to session hijacking, data theft, or other attacks requiring no special permissions or user interaction.

Technologies: mediawiki/semantic-media-wiki (Packagist), Semantic MediaWiki. Vendors: Packagist, Semantic MediaWiki.

Quick answers

Is CVE-2026-77610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77610 being exploited in the wild.
How severe is CVE-2026-77610?: Medium severity, with a CVSS score of 6.1, published 18 September 2026.
Which products and versions are affected?: mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <UNKNOWN>.
Is there a fix for CVE-2026-77610?: Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77610 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77610?: Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later
```
composer require mediawiki/semantic-media-wiki:^7.2.0
```

Technical details

The vulnerability exists in the `SMW\Query\DebugFormatter` class, which assembles query debug output (via `format=debug` parameter or `Special:Ask` page) and emits it as raw HTML without proper output encoding. The `buildHTML()` method re-serializes ASK query strings but only escapes `[` characters, allowing `<`, `>`, `"`, and `'` to pass through. Similarly, `prettifySQL()` inlines query value literals through SQL-escaping only (no HTML encoding), and `prettifyExplain()` echoes database `EXPLAIN` output containing unencoded WHERE clause values. The vulnerability is a reflected XSS: attacker-controlled query input (e.g., `[[Text::<script>alert()</script>]]`) is reflected in the response via `OutputPage::addHTML()` without sanitization. No special rights are required; exploitation works with predefined text-property fields present on every install. The fix requires applying HTML output-context escaping at the `DebugFormatter` boundary for all three sinks: query string, SQL, and EXPLAIN output.

Affected products

Semantic MediaWiki Semantic MediaWiki <UNKNOWN>

Identifiers

CVE-2026-77610
GHSA-q5fm-9mx6-44f4

Timeline

2026-09-18: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.