Executive brief
The Cargo extension for MediaWiki, which allows for the storage and querying of structured data, contains a security flaw that allows for stored cross-site scripting (XSS). An attacker can inject malicious scripts into map-based data displays by using specially crafted links. If a user views the affected map and clicks on the malicious link, the script could execute in their browser, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Cargo extension for MediaWiki due to improper neutralization of script-related HTML tags in the 'map' output format. Specifically, the extension fails to validate URLs used within map markers, allowing an attacker to store a 'javascript:' URI. When a user interacts with a marker containing this malicious link on a Cargo-generated map, the script executes in the context of the user's session. This issue is tracked as CWE-80 and was resolved in version 3.8.7 by adding URL validation to the CargoMapsFormat.php component.
Affected products
- Wikimedia Foundation MediaWiki - Cargo Extension before 3.8.7
Timeline
- 2026-02-03: disclosed: Vulnerability reported via Phabricator task T416271
- 2026-02-09: patched: Fixes merged into master branch
- 2026-04-07: advisory: CVE-2026-39839 published