Executive brief
A security vulnerability exists in the Cargo extension for MediaWiki, a tool used to store and query data within wiki pages. An attacker can inject malicious scripts into certain data fields, which are then executed in the browsers of other users who view specific administrative or data-summary pages. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Cargo extension for MediaWiki due to improper neutralization of script-related HTML tags in list fields. The root cause is located in the CargoQueryDisplayer component, where individual items within a list field are not properly encoded before being displayed on pages such as Special:CargoTables and action=pagevalues. An attacker can exploit this by storing arbitrary HTML/JavaScript in a Cargo table's list field (e.g., via a template). When a victim views the affected administrative pages, the malicious script executes in their browser context. The issue is fixed in version 3.8.7.
Affected products
- Wikimedia Foundation MediaWiki - Cargo Extension before 3.8.7
Timeline
- 2026-02-03: disclosed: Vulnerability reported via Phabricator task T416389
- 2026-02-09: patched: Fix merged into master branch
- 2026-04-07: advisory: CVE-2026-39841 published