Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77607, is a reflected Cross-Site Scripting (XSS) in Semantic MediaWiki's Special:Ask table sep parameter. The sep parameter, which defines the separator for table cell values, was being inserted directly into the HTML output without proper sanitization. This allowed an attacker to inject arbitrary HTML, including script tags, leading to XSS.
Analysis of the commit 5821b9b865c58d40e5ecd1aa807b79fa32eb5c2f, titled 'Escape the table sep separator in HTML output', clearly shows the fix. The key change is in the src/Query/ResultPrinters/TableResultPrinter.php file, specifically within the getCellContent method. Prior to the patch, the line - $html = implode( $this->params['sep'], $values ); directly used the unsanitized sep parameter. The patch replaced this with + $html = implode( $this->getValueSeparator( $outputMode ), $values );, introducing a new getValueSeparator method responsible for sanitizing the input.
The getValueSeparator method now checks the outputMode. For non-wiki output modes (HTML, raw request, file), it escapes the sep parameter using htmlspecialchars unless it matches a safe <br> variant. This ensures that any malicious HTML injected via the sep parameter is properly escaped before being rendered, preventing the XSS.
Therefore, the TableResultPrinter.getCellContent function is identified as the vulnerable function because it was the point where the unsanitized sep parameter was directly incorporated into the HTML output, enabling the XSS exploitation.
TableResultPrinter.getCellContentsrc/Query/ResultPrinters/TableResultPrinter.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/semantic-media-wiki | composer | <= 7.1.0 | 7.2.0 |