This vulnerability in the Mediawiki Cargo extension (versions up to 3.9.4) is due to improper neutralization of input during web page generation, classified as CWE-79 (cross-site scripting). It allows reflected XSS attacks, where malicious scripts can be injected and executed in the context of a user's browser. The CVSS 4.0 vector indicates the attack is network-based, requires low attack complexity, no privileges or user interaction, and results in low impact on confidentiality. The vulnerability was published on 2026-09-25 by the Wikimedia Foundation.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the affected web application. The impact is rated as medium severity with low confidentiality impact and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Wikimedia Foundation's advisories for updates. Until a fix is available, consider applying temporary mitigations such as input validation or output encoding if feasible.