Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-39840

What is CVE-2026-39840?

A cross-site scripting (XSS) vulnerability has been identified in the Cargo Extension of the Wikimedia Foundation's Mediawiki platform. This flaw allows attackers to inject malicious scripts into the web pages generated by Mediawiki, specifically targeting non-script elements. This vulnerability poses serious risks, as it can lead to the execution of harmful scripts in the context of unsuspecting users' browsers, potentially compromising sensitive data and user interactions. All users running versions prior to 3.8.7 of the Cargo Extension are advised to upgrade to a patched version promptly to mitigate these security risks.

References