CVE-2026-103049: XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
Published Sep 29, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS.
This issue affects Mediawiki - Cargo extension: before 1.46.1.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Cargo extension<1.46.1
Event History
Sep 29, 2026
CVE Published
via MITRE·11:08 PM
Data Sourced
via MITRE·11:08 PM
DescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki installations using the Cargo extension are affected if the extension version is earlier than 1.46.1.
2
What kind of attacker interaction is involved?
The vulnerability is a reflected XSS issue in Cargo's Special:CargoQuery page involving unsanitized table headers. The provided information does not specify the required attacker permissions or request parameters.