CVE-2026-58521

CriticalCVSS 9.8

Published: 01/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A SQL injection vulnerability was found in the Cargo extension for MediaWiki due to improper neutralization of special elements in SQL commands. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.

Risk Assessment

An attacker can exploit this vulnerability to execute unauthorized SQL queries, potentially leading to data leakage, modification, or deletion in the MediaWiki database.

Recommendation

Immediately update the Cargo extension to version 1.43.9, 1.44.6, or 1.45.4, depending on the MediaWiki branch in use.

Original NVD description (English source)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.