Executive brief
The Cargo extension for MediaWiki, which allows users to store and query data within wiki pages, contains a security flaw in its dynamic table display. An attacker with basic editing permissions can insert malicious scripts into a page that will execute in the browser of other users who view that page. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the WikiWorks MediaWiki Cargo extension before version 3.8.7. The vulnerability is located in the dynamic table format script, which retrieves HTML content from non-reserved 'data-' attributes that can be manipulated via standard wikitext. Because these attributes were not properly neutralized or restricted to reserved 'data-mw-' namespaces (which are protected by MediaWiki's sanitizer), an attacker with low privileges can inject arbitrary JavaScript. When a victim interacts with the affected table row, the script executes in their browser context. The fix involves migrating to reserved data attributes and ensuring the extension only processes tables marked with trusted internal attributes.
Affected products
- Wikimedia Foundation MediaWiki - Cargo Extension before 3.8.7
Timeline
- 2026-02-03: disclosed: Vulnerability reported via Phabricator
- 2026-02-09: patched: Fix merged into master branch
- 2026-04-07: advisory: Public advisory and CVE assigned