The vulnerability in the Cargo extension allows an attacker to embed malicious JavaScript in responses that are returned to users. The improper neutralization of input can lead to execution of attacker‑controlled code in the victim’s browser, compromising confidentiality, integrity, and availability of the web session. This flaw is a classic reflected XSS reflected XSS weakness (CWE-79).

The weakness exists in MediaWiki’s Cargo extension through version 3.9.4. Any installation of this extension within MediaWiki that has not been updated beyond that revision is vulnerable.

The CVSS score of 6.9 indicates a high severity vulnerability, and the EPSS score is currently not available, leaving the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers could send a crafted request to a user that triggers the unsafe rendering of a query alias, resulting in the execution of payloads in the victim’s browser. Because the vulnerability is reflected, the attack can be performed remotely via crafted URLs or form inputs, making it broadly exploitable by attackers who can drive traffic to the target system.