Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-96876: MediaWiki Cargo extension can let attackers run scripts
CVE-2026-96876 · published 1 month ago
Summary
The Cargo add‑on for MediaWiki may show error messages that include whatever a user types, letting a malicious person insert hidden code into a page. When another visitor views that page, the hidden code can run in their browser, potentially stealing information or performing actions as that user. Update the Cargo extension to the latest version or apply the provided patch and ensure input is properly filtered.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| the wikimedia foundation | mediawiki - cargo extension | <= 3.9.4 |
Original advisory text
Anonymous reflected XSS in CargoExport invalid-alias errors
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.
This issue affects Mediawiki - Cargo extension: through 3.9.4.
This issue affects Mediawiki - Cargo extension: through 3.9.4.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Sep 2026
Updated4 Nov 2026
First seen25 Sep 2026
Track software like this
Free during beta