| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki/semantic-media-wiki | < 7.2.0 | 7.2.0 |
sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (request_type=raw), so the injection was reachable without authentication.
sep is escaped unless it is a safe <br> variant.If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free