THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-q5fm-9mx6-44f4 (medium) — Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

[GHSA] GHSA-q5fm-9mx6-44f4 (medium) — Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

medgithub_advisoriesPublished 2026-09-18

GHSA-q5fm-9mx6-44f4 Severity: medium CVE: CVE-2026-77610

Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

## Query debug output XSS

#### Failure mode

Semantic MediaWiki's query debug output (`format=debug`, or the `debug` request parameter on `Special:Ask`) is assembled by `SMW\Query\DebugFormatter` and emitted as raw HTML. Several of its sinks apply no output-context encodin

Indicators of compromise

CVE-2026-77610cve

Original source: https://github.com/advisories/GHSA-q5fm-9mx6-44f4