{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amediawikicargomediawiki/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mediawiki:cargo:*:*:*:*:*:mediawiki:*:*"],"_cs_cves":[{"id":"CVE-2026-96876"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cargo (\u003c= 3.9.4)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Wikimedia"],"content_html":"\u003cp\u003eThe MediaWiki Cargo extension, versions up to 3.9.4, contains a security vulnerability (CVE-2026-96876) resulting from improper sanitization of exception messages. Specifically, error messages generated during export operations fail to HTML-escape untrusted input derived from field-alias text. An unauthenticated attacker can craft a malicious HTTP request that forces the application to return an error page containing executable markup. If a victim visits the crafted URL, the injected script executes within the context of the wiki origin, potentially allowing unauthorized actions or data access using the victim's session privileges. The vulnerability was reported by Marco Paciaroni and fixed by the upstream maintainers via a patch that mandates HTML-escaping for all exception messages before rendering them in export responses.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for reflected cross-site scripting (XSS) in the context of the affected wiki. An attacker can use this to execute arbitrary JavaScript in the victim's browser session, which could lead to session hijacking, defacement of the wiki content, or unauthorized interactions with the wiki platform. As this is an unauthenticated vector, any public-facing MediaWiki instance utilizing the Cargo extension (version 3.9.4 or earlier) is potentially at risk of exploitation by external actors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the MediaWiki Cargo extension to a version that includes the fix for CVE-2026-96876.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided patch available at the Gerrit tracking task: \u003ca href=\"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328630\"\u003ehttps://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328630\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAudit existing MediaWiki configurations to identify if the Cargo extension is enabled and confirm the current version in use.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-29T15:35:57Z","date_published":"2026-09-29T15:35:57Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cargo-xss/","summary":"The Cargo extension for MediaWiki is vulnerable to reflected XSS via unescaped field-alias text in export error messages, allowing unauthenticated attackers to execute arbitrary scripts in the wiki's origin.","title":"Reflected Cross-Site Scripting in MediaWiki Cargo Extension","url":"https://feed.craftedsignal.io/briefs/2026-09-cargo-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mediawiki:cargo:*:*:*:*:*:mediawiki:*:*","version":"https://jsonfeed.org/version/1.1"}