CVE-2026-58519: Mediawiki Cargo Extension Stored XSS Vulnerability – CVSS 5.4

Technical summary

CVE-2026-58519 is a stored XSS vulnerability (CWE-79) in the Mediawiki Cargo Extension affecting versions before 3.9.1. The extension fails to properly neutralize user-supplied input before rendering it in web page output, allowing authenticated attackers to persist malicious JavaScript payloads. The vulnerability requires user interaction (UI:R in the CVSS vector) and assumes an authenticated attacker with limited privileges (PR:L), but the impact crosses security boundaries (S:C), affecting confidentiality and integrity of user sessions and data.

Business impact

Stored XSS in a collaborative content management system like Mediawiki poses significant organizational risk. Attackers with legitimate accounts can deface wiki content, steal administrative credentials through phishing overlays, harvest sensitive information viewed by other users, or manipulate documented procedures and institutional knowledge. This is particularly damaging in internal wikis used for operational documentation, where compromised content could misdirect personnel or expose confidential processes.

Affected systems

Organizations running Mediawiki with the Cargo Extension installed in any version prior to 3.9.1 are vulnerable. The Cargo Extension is commonly used to manage structured data and templates within Mediawiki instances. Both public-facing and internal wiki deployments are at risk if they permit authenticated user contributions.

Exploitability

Exploitation requires valid user credentials and relies on victim interaction—specifically, the victim must view the attacker's injected content. The barrier to exploitation is moderate: any authenticated user can craft and submit malicious input, and the stored nature of the payload means the attacker does not need to be present when victims are compromised. This makes it a persistent, scalable attack vector in collaborative environments with many users.

Remediation

Upgrade the Mediawiki Cargo Extension to version 3.9.1 or later, which includes proper input neutralization. Organizations should verify the upgrade path against the Wikimedia Foundation advisory and test in non-production environments before deploying to live wiki instances. For temporary mitigation on unpatched systems, restrict edit permissions to trusted users and monitor recent edits for suspicious content injection patterns.

Patch guidance

Apply the update to Mediawiki Cargo Extension version 3.9.1 or higher. Verify compatibility with your current Mediawiki core version and any dependent extensions before deployment. The Wikimedia Foundation provides patch release notes through their official channels; consult those for rollback procedures and known compatibility issues. Test the upgrade in a staging environment and plan a controlled rollout to production to minimize disruption to active wiki users.

Detection guidance

Monitor Mediawiki logs for unusual edit patterns, particularly submissions containing JavaScript snippets, iframe tags, or event handler attributes (onclick, onload, etc.). Review recent page revisions for script injection indicators. Network-based detection should flag requests to your wiki containing encoded payloads (e.g., %3Cscript%3E or base64-encoded JavaScript). Implement content security policy (CSP) headers to limit script execution even if injection occurs, and audit user account activity for compromised or suspicious accounts performing mass edits.

Why prioritize this

This vulnerability merits timely but not emergency remediation. While the CVSS score of 5.4 (Medium) reflects the requirement for authentication and user interaction, the stored XSS nature and wide user base exposure in collaborative systems elevates practical risk. Prioritize patching if your Mediawiki instance is internal-facing with sensitive operational documentation, or if it has a large number of authenticated external contributors. Public wikis with strict editor vetting and robust content moderation may have lower immediate risk.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium severity) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-level privileges to exploit (PR:L), and requirement for user interaction (UI:R). The scope is changed (S:C), meaning the impact extends to resources beyond the security scope of the vulnerable component, yielding low confidentiality and integrity impacts (C:L, I:L) with no availability impact (A:N). The score appropriately captures that this is a significant but contained risk requiring both attacker credentials and victim interaction to fully manifest.

Frequently asked questions