{"id":"CVE-2026-77610","aliases":["GHSA-q5fm-9mx6-44f4"],"url":"https://o3.security/vulnerability/CVE-2026-77610","summary":"Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)","details":"## Query debug output XSS\n\n#### Failure mode\n\nSemantic MediaWiki's query debug output (`format=debug`, or the `debug` request parameter on `Special:Ask`) is assembled by `SMW\\Query\\DebugFormatter` and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping:\n\n- `buildHTML()` echoes the re-serialized ASK query string escaping only `[`; `<`, `>`, `\"`, `'` pass through.\n- `prettifySQL()` returns the generated SQL verbatim. Query value literals are inlined into the SQL through the database layer's quoting (SQL-escaping only, no HTML encoding), so markup in a value survives.\n- `prettifyExplain()` echoes `EXPLAIN` output; on PostgreSQL the plan text contains the `WHERE` literals.\n\nOn `Special:Ask` the resulting string is concatenated into the page and sent through `OutputPage::addHTML`, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices.\n\nThis is a reflected XSS: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text/blob-typed property (whose value is re-serialized verbatim); the predefined `_txt` properties (`Text`, etc.) that ship on every install satisfy this, so no attacker-created content is needed. Example request:\n\n```\nSpecial:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1\n```\n\n#### Remediation\n\n- Apply output-context escaping at the `DebugFormatter` boundary. The `buildHTML()` contract already assumes its inputs are HTML-safe, but its callers do not honour that; escape each entry value on emission, and the SQL and `EXPLAIN` strings before they are wrapped.\n- Escaping only the query-string echo is insufficient: `prettifySQL()` and the \"Auxilliary Tables\" executed-query text carry the same attacker-controlled literals.\n\n#### Scope\n\nThe `prettifySPARQL()` sink already encodes `<` and `>` and is not affected. The same debug path is also reachable through inline `{{#ask:...|format=debug}}`, but that output returns into parser context and is sanitized there; the reflected `Special:Ask` path is the exposed sink.\n\n#### Relationship to GHSA-5jhc-3j2f-52rv\n\nThis issue was identified while splitting the consolidated report GHSA-5jhc-3j2f-52rv into per-vulnerability advisories. It is distinct from the four items in that report (plain table header, `sep`, `SearchByProperty` value, open redirect) and from `Special:Ask` form-input XSS (which is escaped separately).","published":"2026-09-18T16:55:01.848Z","modified":"2026-10-28T02:30:51.894628491Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"mediawiki/semantic-media-wiki","fixedVersion":"7.2.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77610.json"},{"type":"ADVISORY","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-q5fm-9mx6-44f4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77610"},{"type":"PACKAGE","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:51.894628491Z"}}