CVE-2026-58519 is a stored cross-site scripting vulnerability in the Mediawiki Cargo Extension maintained by the Wikimedia Foundation. The vulnerability arises from improper input neutralization during web page generation, classified under CWE-79. It affects all versions prior to 3.9.1. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable over the network without privileges or user interaction, with low to low impact on confidentiality, integrity, and availability. No official remediation level or patch information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to inject and execute arbitrary scripts in the context of users visiting affected Mediawiki instances using the Cargo Extension. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the victim's browser. The impact is rated medium based on the CVSS score and vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the Wikimedia Foundation's advisories for updates. Until a patch is available, consider applying input validation or output encoding workarounds if feasible.