EUVD-2026-40901
GHSA-r23x-87q7-xq2f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS with no complexity; PR:N reflects open-editing wikis; UI:R required as victim must load the poisoned page; scope changes to browser context.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.
This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.
AnalysisAI
Stored cross-site scripting in the Wikimedia Foundation's MediaWiki Cargo Extension (all versions before 3.9.1) allows attackers to inject persistent malicious scripts into wiki pages rendered through the Cargo data-display system. The CVSS 4.0 vector carries E:A (evidence of active exploitation), elevating this beyond a theoretical risk. Successful exploitation enables session hijacking, credential theft, and in-browser payload delivery against any user who views an affected Cargo-rendered page.
Technical ContextAI
The MediaWiki Cargo Extension (CPE: cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_cargo_extension:*:*:*:*:*:*:*:*) adds structured-data storage and querying to MediaWiki by allowing wiki editors to define database-backed tables and display query results on wiki pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input passed through Cargo's data-storage or query-display pipeline is not adequately sanitized before being embedded in HTML output. Because Cargo renders structured data directly into page HTML, a poisoned field value persists in the underlying data store and is re-injected into every page load that queries or displays it, making this a stored (Type II) XSS rather than reflected.
RemediationAI
Upgrade the MediaWiki Cargo Extension to version 3.9.1 or later, which incorporates the fix committed in Gerrit change 1277612 (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1277612). The patched version 3.9.1 is confirmed by the advisory scope statement. If immediate upgrade is not feasible, restrict wiki editing permissions to trusted authenticated users only via MediaWiki's $wgGroupPermissions configuration to eliminate the PR:N attack surface - note this may break anonymous contribution workflows. Additionally, enabling MediaWiki's Content Security Policy (CSP) headers via $wgCSPHeader can limit the impact of any injected scripts by restricting script execution origins, though CSP is a mitigation layer, not a fix. Review existing Cargo table data for suspicious script payloads as part of incident response, since stored XSS means malicious content may already be present in the database.
More in Mediawiki Cargo Extension
View allSQL injection in the Wikimedia Foundation's MediaWiki Cargo Extension exposes wiki deployments to unauthenticated databa
SQL injection in the Wikimedia Foundation's Cargo Extension for MediaWiki exposes all installations running versions pri
Stored cross-site scripting (XSS) in the Mediawiki Cargo Extension before version 3.8.7 allows authenticated users to in
Stored XSS vulnerability in Wikimedia Cargo Extension before 3.8.7 allows authenticated users with page editing permissi
Stored XSS in Wikimedia Cargo Extension before 3.8.7 allows authenticated users with page editing privileges to inject m
Cross-site scripting (XSS) vulnerability in Mediawiki Cargo Extension before version 3.8.7 allows authenticated users to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today