CVE-2026-39839: 
NixOS vulnerability analysis and mitigation

CVE-2026-39839 is a stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki Cargo Extension, classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The vulnerability allows attackers to inject malicious scripts that are persistently stored and executed in the browsers of users who view the affected content. All versions of the Cargo Extension before 3.8.7 are affected. It was published on April 7, 2026, with a patch released shortly after. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is improper neutralization of script-related HTML tags in user-supplied input processed by the Cargo Extension's map format feature (CWE-80). Specifically, the extension fails to sanitize parameters such as URLs before storing and rendering them, allowing injection of javascript: URI schemes and other script-bearing HTML constructs. An attacker can craft a MediaWiki template with a malicious payload (e.g., javascript:alert(...)) passed as a URL parameter to Cargo's map format, which is then stored in the wiki and executed when other users navigate to the affected Special:CargoQuery page. Detailed reproduction steps, including template creation and parameter injection techniques, are publicly documented in the Wikimedia Phabricator issue tracker (Phabricator, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who views the affected wiki content, enabling session token theft, unauthorized actions performed on behalf of victims, and modification of page content. The subsequent system impact is rated High for both confidentiality and integrity, meaning sensitive user data and wiki content integrity can be significantly compromised. Availability is not directly impacted, but the persistent nature of stored XSS means the malicious payload remains active until explicitly removed (GitHub Advisory, Phabricator).

A proof-of-concept with detailed step-by-step reproduction instructions is publicly available on the Wikimedia Phabricator issue tracker, including specific template creation steps and query parameters to trigger the XSS (Phabricator). There is no current evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.044% (very low probability of exploitation within 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify MediaWiki instances running the Cargo Extension at a version prior to 3.8.7. This can be done by checking the wiki's Special:Version page or inspecting HTTP responses for Cargo-related metadata.
2. Create a malicious template: On the target wiki (with an account that has template creation privileges), create a template (e.g., Template:XSS) that passes user-supplied parameters directly into Cargo's map format, including a URL field.
3. Inject the payload: Create or edit a wiki page that invokes the malicious template with a javascript: URI as the URL parameter, e.g., {{XSS|URL=javascript:alert('Map XSS')|lat=1|lon=2|Text=Click me}}.
4. Trigger via CargoQuery: Navigate to /wiki/Special:CargoQuery with the appropriate query parameters to render the Cargo map output containing the injected payload.
5. Victim interaction: When any user (including administrators) clicks the rendered link or map element on the affected page, the injected JavaScript executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Phabricator).

• Logs: MediaWiki access logs showing requests to Special:CargoQuery with unusual or encoded query parameters; log entries for template creation or page edits containing javascript: strings or encoded script tags.
• File System / Database: Wiki pages or templates in the MediaWiki database containing javascript: URIs, <script> tags, or HTML event handler attributes (e.g., onerror=, onload=) within Cargo-related fields.
• Network: Outbound requests from victim browsers to attacker-controlled domains following interaction with Cargo map elements; unexpected POST requests to external endpoints originating from wiki page visits.
• Process/Application: Unexpected JavaScript execution errors or alerts reported by users when viewing Special:CargoQuery results or pages using Cargo map format templates (Phabricator).

The primary remediation is to upgrade the MediaWiki Cargo Extension to version 3.8.7 or later, which contains the fix for this vulnerability. Patches are available via the Wikimedia Gerrit repositories (Gerrit patch 1, Gerrit patch 2). As interim mitigations, administrators should implement Content Security Policy (CSP) headers to restrict script execution, audit stored wiki content for injected malicious scripts, and consider temporarily disabling the Cargo Extension if immediate patching is not feasible (GitHub Advisory).