# CVE-2026-39837: Wikimedia MediaWiki Cargo Extension stored XSS in dynamic table format

Source: https://junglewise.ai/threats/cve-2026-39837-wikimedia-mediawiki-cargo-extension-stored-xss-in-dynamic-table  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39837 · Severity: medium · CVSS 5.4 · Published 2026-04-07

The Cargo extension for MediaWiki, which allows users to store and query data within wiki pages, contains a security flaw in its dynamic table display. An attacker with basic editing permissions can insert malicious scripts into a page that will execute in the browser of other users who view that page. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technologies: [Wikimedia Foundation Cargo Extension](https://junglewise.ai/threats/technologies/cargo-extension). Vendors: [Wikimedia Foundation](https://junglewise.ai/threats/vendors/wikimedia-foundation).

## Quick answers

**Is CVE-2026-39837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39837 being exploited in the wild.

**How severe is CVE-2026-39837?** Medium severity, with a CVSS score of 5.4, published 7 April 2026.

**Which products and versions are affected?** Wikimedia Foundation Cargo Extension before 3.8.7.

**Is there a fix for CVE-2026-39837?** A patch was published on 2026-02-09: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39837 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39837?** Check whether you run Wikimedia Foundation Cargo Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the WikiWorks MediaWiki Cargo extension before version 3.8.7. The vulnerability is located in the dynamic table format script, which retrieves HTML content from non-reserved 'data-' attributes that can be manipulated via standard wikitext. Because these attributes were not properly neutralized or restricted to reserved 'data-mw-' namespaces (which are protected by MediaWiki's sanitizer), an attacker with low privileges can inject arbitrary JavaScript. When a victim interacts with the affected table row, the script executes in their browser context. The fix involves migrating to reserved data attributes and ensuring the extension only processes tables marked with trusted internal attributes.

## Affected products

- Wikimedia Foundation MediaWiki - Cargo Extension before 3.8.7

## Timeline

- 2026-02-03: disclosed: Vulnerability reported via Phabricator
- 2026-02-09: patched: Fix merged into master branch
- 2026-04-07: advisory: Public advisory and CVE assigned

## References

- [https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237979](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237979)
- [https://phabricator.wikimedia.org/T416402](https://phabricator.wikimedia.org/T416402)

## Related threats

- [Wikimedia MediaWiki Cargo Extension stored XSS in map format](https://junglewise.ai/threats/cve-2026-58519-wikimedia-mediawiki-cargo-extension-stored-xss-in-map-format)
- [Wikimedia MediaWiki Cargo Extension stored XSS in list fields](https://junglewise.ai/threats/cve-2026-39841-wikimedia-mediawiki-cargo-extension-stored-xss-in-list-fields)
- [Wikimedia MediaWiki Cargo Extension stored XSS in map format](https://junglewise.ai/threats/cve-2026-39839-wikimedia-mediawiki-cargo-extension-stored-xss-in-map-format)