CVE-2026-77607

#### Failure mode `sep` was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard `Special:Ask` render and for its raw request output (`request_type=raw`), so the injection was reachable without authentication. #### Remediation - In all non-wiki output modes (HTML, raw request, file), `sep` is escaped unless it is a safe `<br>` variant. - This preserves legitimate line-break separators while blocking markup injection. #### Maintenance note If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.