MediaWiki Cargo EUVD-2026-87318

Exploitation requires a MediaWiki installation with the Cargo extension enabled (version 3.9.4 or earlier); Cargo is an optional add-on, not part of core MediaWiki, so vulnerable surface is limited to wikis that have installed it. Being reflected (not stored) XSS, an attacker cannot passively plant the payload - a victim user must be lured into clicking or opening an attacker-crafted URL, which materially limits real-world exploitation despite the network vector. Impact is confined to the victim's browser session on the wiki origin.

This is a genuine but modest-severity issue best treated as routine patching, not an emergency. CVSS 4.0 6.9 (Medium) reflects network vector, low complexity, no privileges, and only Low confidentiality impact with a scope change to the victim's browser (SC:L) - consistent with reflected XSS, which harms the tricked user rather than the server. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced (the sole reference is a Wikimedia phabricator tracking ticket, T434977), so exploitation is unproven. A notable data conflict: the NVD 4.0 vector states UI:N (no user interaction), but reflected XSS by definition requires the victim to follow an attacker-crafted URL - UI should be UI:P/UI:R, which mildly overstates the automatable, no-interaction nature of this bug. No fixed version is stated in the input, only 'affected through 3.9.4', so the remediation target is not independently confirmed here.

An attacker crafts a URL containing a malicious script payload in a parameter handled by the Cargo extension and delivers it to a wiki user (e.g., via a link on-wiki, email, or chat). When the victim opens the link, the unescaped input is reflected into the generated page and executes in their browser under the wiki's origin, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept is referenced at time of analysis.