CVE-2026-103049: MediaWiki Cargo Extension XSS Vulnerability

CVE-2026-103049 Overview

CVE-2026-103049 is a reflected Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki Cargo extension. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when visited by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The issue affects all Cargo extension releases before version 1.46.1.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in the context of a MediaWiki user, enabling session hijacking, credential theft, and unauthorized wiki modifications performed with the victim's privileges.

Affected Products

Wikimedia MediaWiki Cargo extension versions before 1.46.1

Discovery Timeline

2026-09-30 - CVE-2026-103049 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-103049

Vulnerability Analysis

The Cargo extension provides structured data query and storage capabilities for MediaWiki installations. It renders query results and parameters back into wiki pages served to end users. The vulnerability arises when the extension echoes attacker-controlled input into HTML responses without applying context-appropriate output encoding.

Because the payload is delivered through the request and reflected in the response, exploitation requires a victim to load a crafted URL. Any script executed runs within the origin of the affected wiki, granting access to authentication cookies, CSRF tokens, and any privileged wiki actions available to the victim account.

Root Cause

The root cause is missing or insufficient HTML entity encoding on request-derived values before they are inserted into the generated page. Input that should be treated as data is instead parsed as part of the HTML or JavaScript context, allowing injected markup and script constructs to execute. The upstream fix is tracked in Wikimedia Gerrit change 1310132 and Phabricator task T431567.

Attack Vector

Exploitation follows a standard reflected XSS pattern. An attacker constructs a URL targeting a vulnerable Cargo endpoint on the wiki and embeds a JavaScript payload in a reflected parameter. The attacker delivers the URL through phishing, forum posts, or on-wiki links. When a logged-in editor or administrator visits the link, the injected script runs with that user's privileges and can exfiltrate session data or perform actions such as edits, deletions, or permission changes.

No authenticated exploitation code is available in the referenced advisories. Refer to the Wikimedia Gerrit and Phabricator records above for the technical patch details.

Detection Methods for CVE-2026-103049

Indicators of Compromise

Web server access logs containing Cargo endpoint requests with encoded <script>, javascript:, onerror=, or onload= payloads in query parameters.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading Cargo-generated pages.
MediaWiki audit log entries showing edits, permission changes, or password resets initiated from unusual referrers or IP addresses.

Detection Strategies

Deploy a Web Application Firewall (WAF) ruleset that flags reflected XSS patterns targeting Cargo query parameters and Special pages exposed by the extension.
Monitor MediaWiki request logs for parameter values containing HTML tag characters, event handler attributes, or URL-encoded script fragments.
Enable Content Security Policy (CSP) violation reporting to surface injection attempts that browsers block on modern clients.

Monitoring Recommendations

Correlate suspicious Cargo request patterns with subsequent privileged wiki actions to identify successful compromises.
Alert on administrator or bureaucrat account activity that follows a click on an externally referred Cargo URL.
Track any inline script execution warnings surfaced through browser CSP reports for wiki hostnames.

How to Mitigate CVE-2026-103049

Immediate Actions Required

Upgrade the MediaWiki Cargo extension to version 1.46.1 or later on every affected wiki installation.
Invalidate active sessions for privileged accounts after patching to remove any tokens that may have been captured.
Review recent wiki edits, user rights changes, and account activity for signs of exploitation while the vulnerability was exposed.

Patch Information

The fix is delivered in Cargo extension release 1.46.1. The upstream code change is available in Wikimedia Gerrit change 1310132, and coordination details are tracked in Phabricator task T431567. Administrators running MediaWiki with Cargo should apply the update through their standard extension management workflow.

Workarounds

Temporarily disable the Cargo extension in LocalSettings.php if immediate upgrade is not feasible.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to Cargo-provided Special pages to trusted user groups until the patch is deployed.

bash

# Configuration example
# Disable the Cargo extension in LocalSettings.php until patching is complete
# wfLoadExtension( 'Cargo' );

# After upgrading, verify the installed version
cd /var/www/mediawiki/extensions/Cargo
git describe --tags