Cross-Site Scripting Vulnerability in Mediawiki Cargo Extension
CVE-2026-96878

6.9MEDIUM

Key Information:

Vendor

The Wikimedia Foundation

Status
Mediawiki - Cargo Extension
Vendor
CVE Published:
25 September 2026

What is CVE-2026-96878?

A vulnerability within the Mediawiki Cargo extension allows for improper neutralization of input during web page generation, leading to reflected cross-site scripting (XSS). This issue can potentially enable an attacker to execute arbitrary JavaScript code in the context of the affected user's session, increasing the risk of unauthorized data access or manipulation. Users of Mediawiki should ensure they are using an updated version to mitigate these risks.

Affected Version(s)

Mediawiki - Cargo extension 0 <= 3.9.4

References

https://phabricator.wikimedia.org/T434784

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bombobombone - https://bombobombone.github.io
.