Is CVE-2026-39837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39837 being exploited in the wild.

How severe is CVE-2026-39837?

Medium severity, with a CVSS score of 5.4, published 7 April 2026.

Which products and versions are affected?

Wikimedia Foundation Cargo Extension before 3.8.7.

Is there a fix for CVE-2026-39837?

A patch was published on 2026-02-09: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39837 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39837?

Check whether you run Wikimedia Foundation Cargo Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39837: Wikimedia MediaWiki Cargo Extension stored XSS in dynamic table format

CVE-2026-39837 · Severity: medium · CVSS 5.4 · Published 2026-04-07

The Cargo extension for MediaWiki, which allows users to store and query data within wiki pages, contains a security flaw in its dynamic table display. An attacker with basic editing permissions can insert malicious scripts into a page that will execute in the browser of other users who view that page. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technologies: Wikimedia Foundation Cargo Extension. Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-39837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39837 being exploited in the wild.
How severe is CVE-2026-39837?: Medium severity, with a CVSS score of 5.4, published 7 April 2026.
Which products and versions are affected?: Wikimedia Foundation Cargo Extension before 3.8.7.
Is there a fix for CVE-2026-39837?: A patch was published on 2026-02-09: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39837 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39837?: Check whether you run Wikimedia Foundation Cargo Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the WikiWorks MediaWiki Cargo extension before version 3.8.7. The vulnerability is located in the dynamic table format script, which retrieves HTML content from non-reserved 'data-' attributes that can be manipulated via standard wikitext. Because these attributes were not properly neutralized or restricted to reserved 'data-mw-' namespaces (which are protected by MediaWiki's sanitizer), an attacker with low privileges can inject arbitrary JavaScript. When a victim interacts with the affected table row, the script executes in their browser context. The fix involves migrating to reserved data attributes and ensuring the extension only processes tables marked with trusted internal attributes.

Affected products

Wikimedia Foundation MediaWiki - Cargo Extension before 3.8.7

Timeline

2026-02-03: disclosed: Vulnerability reported via Phabricator
2026-02-09: patched: Fix merged into master branch
2026-04-07: advisory: Public advisory and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.