Executive brief
The Cargo extension for MediaWiki, which allows users to store and query data within wiki pages, contains a vulnerability that allows for stored cross-site scripting (XSS). An attacker can inject malicious scripts into map data that will execute in the browser of any user viewing the affected page. This could lead to unauthorized actions being performed on behalf of users, including administrative account takeover or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Cargo extension for MediaWiki due to improper neutralization of input in the 'map' format. Cargo previously stored map data as JSON within the inner content of a <span> element, which could be spoofed or manipulated via wikitext or the language converter. An attacker can craft malicious wikitext containing a fake .cargoMapData element with an XSS payload in the 'title' or 'name' fields. When a user clicks on a map marker, the payload executes in the context of their session. The fix, introduced in version 3.9.1, moves map data to a reserved 'data-mw-cargo-map-data' attribute and ignores elements lacking this attribute.
Affected products
- The Wikimedia Foundation MediaWiki - Cargo Extension before 3.9.1
Timeline
- 2026-04-22: disclosed: Vulnerability reported to Wikimedia Phabricator
- 2026-04-27: patched: Fix merged into master branch
- 2026-07-01: advisory: CVE published and NVD record created