MediaWiki Cargo CVE-2026-103049

Exploitation requires a wiki running the MediaWiki Cargo extension at a version before 1.46.1 and a victim who clicks an attacker-crafted link or loads a crafted page (UI:R). No authentication is needed by the attacker to deliver the payload (PR:N), but impact scales with the privilege of the victim whose browser executes the reflected script. The limiting factors are the mandatory user-interaction step and the reflected (non-persistent) nature, which require per-victim social engineering rather than broad automated exploitation (SSVC Automatable=no); impact is confined to the victim's browser session against the wiki origin (C:L/I:L, no availability impact).

This is a reflected XSS (CWE-79) in the MediaWiki Cargo extension with a vendor CVSS 3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a genuine but not emergency-grade issue: the attack is network-reachable and low-complexity with no privileges required, but it is gated by UI:R - a victim must click a crafted link/load a crafted page - and impact is limited to partial confidentiality and integrity (C:L/I:L) with the S:C scope change reflecting script execution in the victim's browser session against the wiki origin. CISA SSVC reinforces the measured risk: Exploitation=none (no observed exploitation), Automatable=no (reflected XSS requires per-victim social engineering, not mass scripting), Technical Impact=partial. There is no EPSS score provided, no KEV listing, and no public exploit identified at time of analysis, so this is a real-but-moderate priority rather than a high-urgency item. A vendor patch is available (Gerrit change 1310132, fixed in 1.46.1), so the practical response is to upgrade; this is a standard reflected-XSS defect to remediate on normal patch cadence, not a drop-everything emergency.

An attacker crafts a URL to a wiki running the Cargo extension where attacker-controlled input is reflected unescaped into the rendered page (e.g., a Cargo query/parameter). The attacker lures an authenticated editor or admin into clicking the link; the injected JavaScript then executes in the victim's browser under the wiki's origin, enabling session-token theft, CSRF-style actions, or content manipulation as that user. No public exploit code has been identified, and exploitation requires victim interaction (UI:R), limiting it to targeted social-engineering delivery.