Is CVE-2026-103049 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103049 being exploited in the wild.

How severe is CVE-2026-103049?

Informational severity, published 30 September 2026.

Which products and versions are affected?

Wikimedia Foundation MediaWiki Cargo before 1.46.1.

Is there a fix for CVE-2026-103049?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103049 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103049?

Check whether you run Wikimedia Foundation MediaWiki Cargo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103049: Wikimedia MediaWiki Cargo reflected cross-site scripting

CVE-2026-103049 · Severity: info · Published 2026-09-30

The Cargo extension for MediaWiki, a popular open-source wiki platform, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker could craft a malicious link and trick a user into clicking it, leading to session hijacking, credential theft, or defacement of wiki content.

Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-103049 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103049 being exploited in the wild.
How severe is CVE-2026-103049?: Informational severity, published 30 September 2026.
Which products and versions are affected?: Wikimedia Foundation MediaWiki Cargo before 1.46.1.
Is there a fix for CVE-2026-103049?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103049 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103049?: Check whether you run Wikimedia Foundation MediaWiki Cargo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a reflected XSS vulnerability in the Cargo extension for MediaWiki caused by improper input sanitization during web page generation. The attack requires user interaction (clicking a malicious link) and operates over the network. An attacker can execute arbitrary JavaScript in the victim's browser within the context of the wiki application.

Affected products

Wikimedia Foundation MediaWiki Cargo before 1.46.1

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.