MediaWiki Cargo CVE-2026-96878

Exploitation requires an attacker to deliver a crafted URL against a MediaWiki installation that has the Cargo extension (version through 3.9.4) installed and enabled, and a victim must open that link in an authenticated browser session for the reflected payload to gain meaningful context (script executes in the wiki origin). Limiting factors: Cargo is an optional extension not present on all wikis; the attack is reflected (not persistent), so it depends on social engineering the victim into clicking the link - contrary to the vendor's UI:N metric, real-world exploitation needs user interaction. Impact is confined to the victim's browser session within the wiki's origin, not the server host.

This is a reflected cross-site scripting (CWE-79) flaw in the MediaWiki Cargo extension through version 3.9.4, carrying a vendor-assigned CVSS 4.0 base score of 6.9 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L indicates network-reachable, low-complexity, unauthenticated exploitation with low confidentiality impact on both the vulnerable and a subsequent system. A notable internal inconsistency exists: the vendor scored UI:N (no user interaction), yet reflected XSS by definition requires a victim to load or click an attacker-crafted URL - this should realistically be UI:P/Active, which somewhat inflates the raw score. No EPSS probability is supplied, there is no CISA KEV listing, no SSVC decision data, and no public exploit code is referenced (the sole reference is a Wikimedia Phabricator tracking task, T434784). Exploitation status: no public exploit identified at time of analysis. On balance this is a real but moderate-priority issue - a genuine reflected XSS that requires social-engineering a victim (typically an authenticated wiki editor/admin) into clicking a crafted link, not a wormable or automatable unauthenticated compromise. Impact is limited to session-scoped script execution (confidentiality-oriented, low), not host compromise.

An attacker crafts a malicious URL targeting a vulnerable Cargo extension endpoint (e.g. a query/format parameter) that reflects unsanitized input into the generated wiki page, then lures a logged-in wiki user or administrator into clicking it. When the victim's browser renders the reflected payload, attacker-controlled JavaScript executes in the wiki's origin, enabling session token theft, CSRF-style edits, or account actions in the victim's context. No public exploit code has been identified, and successful exploitation depends on the victim opening the crafted link.