The Cargo extension’s Special:CargoQuery page fails to neutralize user-supplied table header input, allowing reflected cross‑site scripting. An attacker can embed malicious JavaScript that executes when the victim views a crafted Cargo query page, potentially hijacking sessions or defacing content.

Mediawiki Cargo extension versions prior to 1.46.1 are vulnerable. The issue applies to any installation of the Cargo extension before that release where users can access or generate Cargo query tables.

The vulnerability is a classic reflected XSS flaw (CWE‑79). Exploitation requires an attacker to supply a crafted table header and persuade a user to visit the resulting URL; no server‑side privileges are needed. The EPSS score of <1% indicates that exploitation is considered low probability, and with a CVSS score of 6.1 the vulnerability falls into a moderate severity range. The issue is not listed in CISA KEV, but the lack of sanitization suggests a higher risk for sites that expose Cargo queries to untrusted users.