MediaWiki Cargo CVE-2026-96875

Exploitation requires the MediaWiki Cargo extension (version 3.9.4 or earlier) to be installed and in use for storing/querying page data. An attacker must be able to save content that populates Cargo-stored data - this depends on the wiki's edit policy (anonymous editing on an open wiki satisfies PR:N, but most production wikis require at least a registered account, making PR:L more realistic). Execution further requires a victim to view the page or Cargo-generated output that renders the un-neutralized data, i.e. user interaction. Wikis that restrict editing to trusted users, disable Cargo, or run a patched version are not exposed.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the MediaWiki Cargo extension through version 3.9.4, reported by the Wikimedia Foundation itself. The only quantitative signal available is the vendor-supplied CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N), which correctly captures the limited, XSS-typical impact: low confidentiality to the vulnerable system plus a low subsequent-system confidentiality effect (the victim's browser session). There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - the sole reference is a Wikimedia Phabricator task, so exploitation status is 'no public exploit identified at time of analysis.' Two vector points warrant scrutiny: the vendor rates PR:N and UI:N, but stored XSS realistically requires (a) the ability to save wiki content carrying the payload - often an account or at least open/anonymous edit rights depending on wiki configuration - and (b) a victim subsequently rendering the affected page, which is genuine user interaction. Treating those as UI:R and (frequently) PR:L lowers the practical risk below what the raw 6.9 suggests. Net: a legitimate, real vulnerability worth patching, but a moderate - not urgent - priority given no active exploitation, no POC, limited (VC:L/SC:L) impact, and dependence on wiki edit/view workflow rather than pure unauthenticated automation.

An attacker with the ability to edit wiki content (an account, or anonymous editing on an open wiki) submits a Cargo-backed page or query whose stored data contains a script payload that is not properly neutralized during page generation. When another user - potentially an administrator - later views the page or a report rendering that Cargo data, the script executes in their browser under the wiki's origin, enabling session/cookie theft or actions on their behalf. No public proof-of-concept is referenced; only a Wikimedia Phabricator tracking task is cited.