Executive brief
The Cargo extension for MediaWiki, which allows users to store and query data within wiki pages, contains a security vulnerability. An attacker can inject malicious styles into page elements, potentially leading to unauthorized actions or data exposure when other users view the affected pages. This could impact the integrity of the wiki content and the security of its users' sessions.
Technical details
A cross-site scripting (XSS) and CSS injection vulnerability exists in the MediaWiki Cargo extension before version 3.8.7. The flaw stems from insufficient validation of input parameters (such as 'width') used in various display formats, including Calendar, BPMN, Gantt, and Timeline. An attacker can provide unsanitized inline styles that are then rendered in the browser of other users. This allows for the injection of arbitrary CSS or JavaScript targeting non-script elements. The vulnerability is exploitable by remote attackers via network requests, typically requiring some level of user interaction (viewing the malicious page). The issue was addressed by implementing stricter CSS size validation in CargoUtils.
Affected products
- Wikimedia Foundation MediaWiki Cargo Extension before 3.8.7
Timeline
- 2026-02-03: disclosed: Vulnerability reported and task created in Phabricator
- 2026-02-09: patched: Fix merged into master branch
- 2026-04-07: advisory: CVE published and advisory made public