CVE-2026-96877: Reflected XSS through Cargo Drilldown full-text search

Q: Which deployments are affected?

MediaWiki installations using the Cargo extension are affected if they run Cargo version 3.9.4 or earlier.

Q: Where does the vulnerable input reach the application?

The issue is in the Cargo Drilldown full-text search, where insufficiently neutralized input can be reflected in generated web content.

Published Sep 25, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.

This issue affects Mediawiki - Cargo extension: through 3.9.4.

Affected Software

1 affected component

MediaWiki Cargo<=3.9.4

Event History

Sep 25, 2026

CVE Published

via MITRE·07:39 PM

Data Sourced

via MITRE·07:39 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

MediaWiki installations using the Cargo extension are affected if they run Cargo version 3.9.4 or earlier.

Where does the vulnerable input reach the application?

The issue is in the Cargo Drilldown full-text search, where insufficiently neutralized input can be reflected in generated web content.