Critical severity9.8NVD Advisory· Published Jul 1, 2026· Updated Jul 7, 2026

CVE-2026-14363

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

Affected products

MediaWiki/Cargo
cpe:2.3:a:mediawiki:cargo:*:*:*:*:*:mediawiki:*:*
Range: <3.9.1
Wikimedia Foundation/MediaWiki Cargo extensionllm-fuzzy
Range: <1.43.9, 1.44.6, 1.45.4
Wikimedia Foundation/Mediawikillm-fuzzy
Range: <1.43.9, 1.44.6, 1.45.4

Patches

Vulnerability mechanics

References

phabricator.wikimedia.org/T422774nvdThird Party Advisory
gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1269701nvdIssue Tracking
gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1279498nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000