Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Failure mode When headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation - TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is...

GHSA-3JP5-3H47-28QF Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Failure mode When headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation - TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is...

PT-2026-95498

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description When the headers parameter is set to plain, table header text is emitted into the element via a raw HTML path. This allows user-controlled content within the mainlabel variable to be...