Mediawiki Cargo Extension CVE-2026-39841

The Cargo Extension for MediaWiki provides database querying and template functionality for wiki pages. The vulnerability stems from insufficient HTML sanitization (CWE-80: Improper Neutralization of Script-Related HTML Tags) in the extension's tag processing logic, allowing script-related HTML elements to bypass filtering and persist in the wiki database. Attackers with editing privileges (PR:L per CVSS vector) can embed malicious <script> tags or event handlers that execute when other users render pages containing the vulnerable Cargo template or query output. The root cause is inadequate input validation before storage and output encoding before rendering in the wiki environment where content trust is assumed for editors but not enforced at the HTML level.