Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77608, is a reflected Cross-Site Scripting (XSS) in Semantic MediaWiki's Special:SearchByProperty page. The core issue was that user-supplied input from the property and value parameters was reflected back into the rendered HTML output without proper sanitization or encoding. This occurred in two main scenarios: when displaying validation error messages related to these parameters and when displaying the 'value' in the result heading. The ProcessingErrorMsgHandler::getMessagesAsString function, which generated error messages, and the getShortHTMLText method, which formatted the value for display, produced output that could contain unescaped user input. This output was then directly embedded into the HTML by the getResultHtml function of the PageBuilder class, leading to the XSS. The patch addresses this by introducing a new escapeMessage function that applies htmlspecialchars to the potentially malicious strings before they are rendered into the HTML, thereby neutralizing any injected scripts. The change from getShortHTMLText to getWikiValue followed by escapeMessage for the result message further reinforces the need for explicit encoding of user-controlled data in this context.
SMW\MediaWiki\Specials\SearchByProperty\PageBuilder::getResultHtmlsrc/MediaWiki/Specials/SearchByProperty/PageBuilder.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/semantic-media-wiki | composer | <= 7.1.0 | 7.2.0 |