CVE-2026-39840: CSS injection in multiple Cargo display formats

Q: What is the severity of CVE-2026-39840?

CVE-2026-39840 is considered a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2026-39840?

To fix CVE-2026-39840, upgrade the MediaWiki Cargo extension to version 3.8.7 or later.

Q: What impact does CVE-2026-39840 have on my MediaWiki installation?

CVE-2026-39840 can allow attackers to inject malicious scripts into web pages, impacting users' data security.

Q: What versions of the MediaWiki Cargo extension are affected by CVE-2026-39840?

CVE-2026-39840 affects versions of the MediaWiki Cargo extension before 3.8.7.

Q: Is CVE-2026-39840 a known vulnerability?

Yes, CVE-2026-39840 is a recognized vulnerability reported within the Wikimedia Foundation MediaWiki Cargo extension.

Published Apr 7, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Affected Software

2 affected components

Wikimedia Foundation MediaWiki Cargo extension<3.8.7

MediaWiki Cargo<3.8.7

Remediation

Patch Available

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237966

Event History

Apr 7, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

DescriptionWeakness

Data Sourced

via NVD·08:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-39840?

CVE-2026-39840 is considered a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2026-39840?

To fix CVE-2026-39840, upgrade the MediaWiki Cargo extension to version 3.8.7 or later.

What impact does CVE-2026-39840 have on my MediaWiki installation?