CVE-2026-39839

MediumCVSS 6.1

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.

Risk Assessment

Attackers can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft or data exfiltration.

Recommendation

Update the Cargo extension for MediaWiki to version 3.8.7 or later.

Original NVD description (English source)

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.