# CVE-2026-77610: Semantic MediaWiki query debug output XSS in DebugFormatter

Source: https://junglewise.ai/threats/cve-2026-77610-semantic-mediawiki-query-debug-output-xss-in-debugformatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77610 · Severity: medium · CVSS 6.1 · Published 2026-09-18

Semantic MediaWiki, an extension that adds structured data capabilities to MediaWiki, contains a reflected cross-site scripting (XSS) vulnerability in its query debug output feature. An attacker can inject malicious scripts into search queries that will be reflected back in the page without proper sanitization, allowing the script to execute in a user's browser when they view the debug output. This can lead to session hijacking, data theft, or other attacks requiring no special permissions or user interaction.

Technologies: [mediawiki/semantic-media-wiki (Packagist)](https://junglewise.ai/threats/technologies/mediawiki-semantic-media-wiki), [Semantic MediaWiki](https://junglewise.ai/threats/technologies/semantic-mediawiki). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Semantic MediaWiki](https://junglewise.ai/threats/vendors/semantic-mediawiki).

## Quick answers

**Is CVE-2026-77610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77610 being exploited in the wild.

**How severe is CVE-2026-77610?** Medium severity, with a CVSS score of 6.1, published 18 September 2026.

**Which products and versions are affected?** mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <UNKNOWN>.

**Is there a fix for CVE-2026-77610?** Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77610?** Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later

  ```sh
  composer require mediawiki/semantic-media-wiki:^7.2.0
  ```


## Technical details

The vulnerability exists in the `SMW\Query\DebugFormatter` class, which assembles query debug output (via `format=debug` parameter or `Special:Ask` page) and emits it as raw HTML without proper output encoding. The `buildHTML()` method re-serializes ASK query strings but only escapes `[` characters, allowing `<`, `>`, `"`, and `'` to pass through. Similarly, `prettifySQL()` inlines query value literals through SQL-escaping only (no HTML encoding), and `prettifyExplain()` echoes database `EXPLAIN` output containing unencoded WHERE clause values. The vulnerability is a reflected XSS: attacker-controlled query input (e.g., `[[Text::<script>alert()</script>]]`) is reflected in the response via `OutputPage::addHTML()` without sanitization. No special rights are required; exploitation works with predefined text-property fields present on every install. The fix requires applying HTML output-context escaping at the `DebugFormatter` boundary for all three sinks: query string, SQL, and EXPLAIN output.

## Affected products

- Semantic MediaWiki Semantic MediaWiki <UNKNOWN>

## Identifiers

- CVE-2026-77610
- GHSA-q5fm-9mx6-44f4

## Timeline

- 2026-09-18: disclosed

## Related threats

- [Semantic MediaWiki authorization bypass in edit protection](https://junglewise.ai/threats/cve-2026-126566-semantic-mediawiki-7-3-1-before-7-4-1-contains-an-incorrect)
- [Semantic MediaWiki denial of service in concept expansion](https://junglewise.ai/threats/cve-2026-126565-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-denial-of)
- [Semantic MediaWiki stored XSS in ValueFormatter property label](https://junglewise.ai/threats/cve-2026-126564-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-stored-cross)
- [Semantic MediaWiki uncontrolled recursion in ConceptDescriptionInterpreter](https://junglewise.ai/threats/cve-2026-126562-semantic-mediawiki-3-0-0-before-7-4-1-contains-an-uncontrolled)
- [Semantic MediaWiki missing authorization in page edit protection](https://junglewise.ai/threats/cve-2026-126561-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-missing)