Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-103049

What is CVE-2026-103049?

The Cargo extension of Wikimedia's Mediawiki platform is susceptible to a reflection-based cross-site scripting vulnerability. This occurs due to improper sanitization of user-supplied input during web page generation, allowing malicious actors to execute harmful scripts in the context of users accessing the affected extension. Users of Mediawiki - Cargo extension prior to version 1.46.1 are particularly at risk and should prioritize upgrading to mitigate possible exploitation.

References