MediaWiki Cargo CVE-2026-96874

Requires an authenticated account with content-editing privileges on a MediaWiki instance that has the Cargo extension installed at version ≤3.9.4 (PR:L). The attacker must inject a script payload into Cargo-managed data that is later rendered to another user; exploitation is limited by high attack complexity (AC:H) and by the need for a second user to view the poisoned Cargo output. Cargo is an optional extension, so instances without it are unaffected; impact is confined to the browser session (low confidentiality/integrity, no availability impact).

This is a low-severity issue and not a patching priority. The input CVSS 4.0 base score is 2.3 (Low), reflecting authenticated exploitation (PR:L), high attack complexity (AC:H), and only low confidentiality/integrity impact confined to the victim's browser session (VC:L/VI:N/VA:N with subsequent-system SC:L/SI:L). No EPSS probability, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' All signals align on low real-world risk: a stored XSS in a MediaWiki extension that requires an account with edit privileges to plant the payload. There is no conflict between the CVSS vector and the description - both point to network-reachable but authenticated, complex exploitation. Note the vulnerable version boundary ('through 3.9.4') is stated but no fixed version is named in the references (only the Cargo source repo and Phabricator task T435207), so the remediated release must be verified with Wikimedia.

An attacker with a low-privileged but edit-capable account on a wiki running the Cargo extension (≤3.9.4) injects a malicious script payload into Cargo-stored/queried content (e.g., a table field rendered on a page). When another user - potentially an administrator - views the page displaying that Cargo data, the script executes in their browser session, enabling session/token theft or actions in their context. No public proof-of-concept was identified, and the high attack complexity plus authentication requirement limit practical exploitation.