Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Medium · CVSS 6.1

## Reflected XSS via a forged cursor pagination token #### Failure mode `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`.

Remediation

Upgrade mediawiki/semantic-media-wiki to 7.2.0 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-cx86-7xwp-w9wf

← All threats