Unrated severityNVD Advisory· Published Jul 1, 2026· Updated Jul 1, 2026

Stored XSS through Cargo's map format

CVE-2026-58519

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

Patches

Vulnerability mechanics

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1277612mitre
phabricator.wikimedia.org/T424140mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000