Stored XSS in MediaWiki Cargo Extension

Compliance Impact

The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in the Mediawiki Cargo Extension directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-58519 is a stored cross-site scripting (XSS) vulnerability in the Cargo extension for MediaWiki, affecting versions up to 3.9.

The issue arises from Cargo's map format, which allows malicious wikitext to inject and execute arbitrary JavaScript code.

An attacker can create a template with a specially crafted Cargo table, then embed a map with an XSS payload in the title field of a marker.

When rendered, the payload executes due to improper handling of map data stored in a <span> element, which can be manipulated via wikitext or the language converter.

The vulnerability was patched by changing the extension to store map data in a reserved data attribute instead of the element's contents, preventing fake map data elements and protecting against language conversion manipulation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the affected MediaWiki site.

Such execution can lead to unauthorized actions such as stealing user credentials, session hijacking, defacing web pages, or performing actions on behalf of legitimate users.

Because the XSS is stored, the malicious code can persist and affect multiple users who view the compromised content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored cross-site scripting (XSS) issue in the Cargo extension for MediaWiki, specifically involving malicious wikitext in Cargo tables that inject JavaScript via map markers' title fields.

Detection involves inspecting rendered pages that use the Cargo extension's map format for suspicious or unexpected JavaScript execution, especially in map marker titles.

Since the vulnerability arises from stored data, network detection might be limited, but you can monitor HTTP responses for suspicious script tags or unexpected inline JavaScript within map elements.

No specific commands are provided in the available resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability was patched by changing how map data is stored in the Cargo extension: from storing map data inside a span element's contents to using a reserved data attribute (`data-mw-cargo-map-data`).

Immediate mitigation steps include upgrading the MediaWiki Cargo extension to version 3.9.1 or later, which contains the fix.

Until the upgrade can be applied, consider restricting user permissions to prevent untrusted users from creating or editing Cargo tables or templates that include map data.

Useful 0 Not Useful 0