MediaWiki Cargo EUVD-2026-87313

Exploitation requires a victim user of a wiki running the MediaWiki Cargo extension at or below version 3.9.4 to open an attacker-crafted URL that reflects unsanitized input into a page. No authentication is required of the attacker (PR:N), but successful attack depends on social-engineering the victim into following the malicious link (reflected XSS inherently needs victim interaction, despite the input vector listing UI:N). Impact is confined to the victim's browser session on the affected wiki; the vulnerable Cargo query/reporting functionality must be enabled (Cargo is a non-core, separately installed extension), which limits exposure to wikis that deploy it.

This is a reflected cross-site scripting (CWE-79) flaw in the MediaWiki Cargo extension through version 3.9.4, reported by the Wikimedia Foundation. The provided CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L) yields 6.9 (medium), signaling network-reachable, unauthenticated, low-complexity attack with low confidentiality impact on both the vulnerable and a subsequent system. However, the UI:N (no user interaction) rating conflicts with the vulnerability class: reflected XSS by definition requires a victim to follow an attacker-crafted request/link, so user interaction should realistically be Passive - verify this discrepancy, as it inflates the score. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence; the only reference is an internal Wikimedia Phabricator task (T435121), consistent with a coordinated vendor-side fix rather than active exploitation. There is no SSVC decision data. Net assessment: a legitimate but moderate client-side flaw whose real-world priority is limited by the need to lure a victim into clicking a crafted link and by the low, session-scoped impact - not a mass-exploitation or high-urgency issue.

An attacker crafts a malicious URL targeting a vulnerable Cargo extension endpoint (e.g., a query/results parameter reflected without neutralization) and delivers it to a wiki user via phishing, chat, or a planted link. When the victim opens the link on the affected wiki, attacker-controlled JavaScript executes in their browser session, enabling session/token theft or actions in the victim's context. No public proof-of-concept is identified in the available data.