The Cargo Extension in MediaWiki fails to fully neutralize user‑supplied input when generating web pages, resulting in a cross‑site scripting (XSS) flaw that targets non‑script elements such as CSS. An attacker who can insert content into a Cargo query or view can cause victim browsers to execute arbitrary JavaScript, which may lead to theft of authentication cookies, defacement of pages, or redirection to malicious sites. The vulnerability remains until the extension reaches version 3.8.7, when input handling is corrected.

All installations of the MediaWiki Cargo Extension deploying a version older than 3.8.7 are potentially vulnerable. This includes many community and enterprise wikis that rely on Cargo for custom database queries and display formats.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is reported, and the flaw is not part of the CISA Known Exploited Vulnerabilities catalogue, suggesting limited current exploitation data. However, the web‑based nature and lack of data sanitisation mean that an attacker can exercise the flaw by crafting a malicious Cargo query or by enabling an attacker‑controlled content block, a straightforward attack path for a determined adversary.