CVE Catalog
CVE-2026-39840
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.
Risk Assessment
An attacker can modify page content, steal data, or perform actions on behalf of the victim.
Recommendation
Update the Cargo extension to version 3.8.7 or later.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.