GHSA-59xw-qv23-j3rc

Source

https://github.com/advisories/GHSA-59xw-qv23-j3rc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-59xw-qv23-j3rc/GHSA-59xw-qv23-j3rc.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-59xw-qv23-j3rc

Aliases

CVE-2026-77608

Published

2026-09-18T16:42:50Z

Modified

2026-09-18T17:00:06Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Details

Failure mode

The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.

Remediation

The form value is escaped before it is placed back into the input field.
Derived error messages are also escaped before being rendered into HTML.

Maintenance note

Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-18T16:42:50Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / mediawiki/semantic-media-wiki

Package

Name: mediawiki/semantic-media-wiki
Purl: pkg:composer/mediawiki/semantic-media-wiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.2.0

Affected versions

1.*

1.9beta1

1.9-RC1

1.9

1.9.0.1

1.9.0.2

1.9.1

1.9.1.1

1.9.2

2.*

2.0-RC1

2.0-RC2

2.0-RC3

2.0

2.1.0-RC1

2.1.0

2.1.1

2.1.2

2.1.3

2.2.0-RC1

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0-RC1

2.3.0

2.3.1

2.4.0-RC1

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.5.0-rc.1

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

3.*

3.0.0-rc.1

3.0.0-rc.2

3.0.0

3.0.1

3.0.2

3.1.0-rc.1

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.2.0-rc.1

3.2.0-rc.2

3.2.0

3.2.1

3.2.2

3.2.3

4.*

4.0.0

4.0.1

4.0.2

4.1.0

4.1.1

4.1.2

4.1.3

4.2.0

5.*

5.0.0

5.0.1

5.0.2

5.1.0

6.*

6.0.0

6.0.1

7.*

7.0.0

7.1.0

Database specific

last_known_affected_version_range

"<= 7.1.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-59xw-qv23-j3rc/GHSA-59xw-qv23-j3rc.json"