CVE-2026-96878

Received Received - Intake

Reflected Cross-Site Scripting in MediaWiki Cargo Extension

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: wikimedia-foundation

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-96878

Affected Vendors & Products

Vendor	Product	Version / Range
mediawiki	cargo	3.9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in the MediaWiki Cargo extension versions up to 3.9.4. It occurs when user input is improperly neutralized during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser.

Detection Guidance

Detecting this reflected XSS vulnerability in the MediaWiki Cargo extension may require manual inspection of web requests and responses. Check for unusual URL parameters or form inputs that reflect user input without proper sanitization. Use browser developer tools to monitor network requests for suspicious payloads.

Impact Analysis

An attacker could trick you into clicking a malicious link, which would execute arbitrary JavaScript in your browser. This could lead to session hijacking, theft of cookies or sensitive data, defacement of web pages, or redirection to malicious sites.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information integrity and confidentiality. Organizations could face fines or penalties for failing to address this risk.

Mitigation Strategies

Immediately update the MediaWiki Cargo extension to the latest version (3.9.4 or higher). If an update is not available, disable the extension until a patch is released. Implement input validation and output encoding for all user-supplied data in web applications.

Hi! I’m here to help you understand CVE-2026-96878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70