CVE-2026-58519 is a stored cross-site scripting vulnerability in the Mediawiki Cargo Extension maintained by the Wikimedia Foundation. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. It affects all versions of the Cargo Extension prior to 3.9.1. The vulnerability allows an attacker to inject malicious scripts that are stored and later executed in the context of users visiting affected pages. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impacts on confidentiality, integrity, availability, scope, and security requirements. No official remediation level or patch link is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The impact is rated medium with a CVSS score of 6.9, reflecting limited but meaningful risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the Wikimedia Foundation's advisories for updates. Until a patch is available, consider applying input validation or output encoding workarounds if feasible to mitigate stored XSS risks in the Cargo Extension.