GHSA-3jp5-3h47-28qf
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Quick fix
GHSA-3jp5-3h47-28qf — mediawiki/semantic-media-wiki: upgrade to the fixed version with the command below.
composer require mediawiki/semantic-media-wiki:^7.2.0Details
#### Failure mode
When `headers=plain`, table header text was emitted into `<th>` via a raw HTML path. User-controlled `mainlabel` content could therefore become executable HTML.
#### Remediation
- `TableResultPrinter` now applies output-context escaping before passing plain headers to the table renderer. - The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.
#### Why this is the right layer
The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 7.2.0composer require mediawiki/semantic-media-wiki:^7.2.0