Cross-Site Scripting Vulnerability in Wikimedia Foundation's Mediawiki Cargo Extension

CVE-2025-62671

What is CVE-2025-62671?

A Cross-Site Scripting (XSS) vulnerability exists in the Wikimedia Foundation's Mediawiki Cargo Extension, which improperly neutralizes input during web page generation. This flaw allows for stored XSS attacks, potentially enabling an attacker to inject malicious scripts that execute in the context of users' browsers. If exploited, this vulnerability could lead to unauthorized actions and theft of sensitive information. The affected version is the master branch of the Cargo Extension.

References