CVE-2026-39841: 
NixOS vulnerability analysis and mitigation

CVE-2026-39841 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki Cargo Extension, caused by improper neutralization of script-related HTML tags in web page output. It affects all versions of the Cargo Extension before 3.8.7. The vulnerability was published on April 7, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and CWE-79 (Cross-Site Scripting), where the Cargo Extension fails to sanitize user-supplied input stored in Cargo list fields before rendering it in wiki pages. An attacker with low-level wiki editing privileges can craft a MediaWiki template containing malicious HTML/script tags (e.g., <script>alert(1)</script>) within a Cargo list field; when the stored data is rendered on pages such as Special:CargoTables or via ?action=pagevalues, the injected script executes in the victim's browser. Detailed reproduction steps are publicly documented in the Wikimedia Phabricator issue tracker, confirming the attack vector involves creating a template with malicious Cargo field values and triggering execution by visiting specific Cargo-generated pages (Phabricator, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who visits the affected MediaWiki pages, enabling session cookie theft, account hijacking, unauthorized actions performed on behalf of victims, and redirection to malicious external sites. Because the payload is stored server-side, all users viewing the compromised page are affected without any further attacker interaction after initial injection. The subsequent system confidentiality and integrity impacts are rated High under CVSS v4.0, reflecting the potential for broad user compromise across the wiki platform (GitHub Advisory, Feedly).

A proof-of-concept exploit with step-by-step reproduction instructions is publicly available in the Wikimedia Phabricator issue tracker (T416389), demonstrating how to trigger an alert box via stored malicious content in Cargo list fields (Phabricator). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, indicating a low near-term exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify a MediaWiki instance running the Cargo Extension at a version prior to 3.8.7. This can be done by checking the wiki's Special:Version page or inspecting page source for Cargo-related markers.
2. Obtain editing access: Register or log in to the target wiki with an account that has template editing permissions (low-privilege access is sufficient).
3. Create a malicious template: Create or edit a MediaWiki template (e.g., Template:XSS) that stores a Cargo list field containing a malicious HTML/script payload, such as <script>alert(document.cookie)</script> or an equivalent tag-based XSS vector.
4. Store the payload: Save the template, causing the malicious content to be persisted in the Cargo database tables associated with the template's defined fields.
5. Trigger execution: Navigate to Special:CargoTables/XSS or Template:XSS?action=pagevalues. The Cargo Extension renders the stored field values without proper sanitization, causing the injected script to execute in the browser.
6. Harvest results: The executed script can exfiltrate session cookies, perform authenticated wiki actions on behalf of the victim, or redirect users to attacker-controlled infrastructure (Phabricator).

• Logs: MediaWiki access logs showing requests to Special:CargoTables/<table_name> or pages with ?action=pagevalues parameters from multiple distinct users in a short timeframe, potentially indicating widespread triggering of a stored payload.
• File System / Database: Unexpected or recently modified MediaWiki templates containing HTML tags such as <script>, <img onerror=, <svg onload=, or similar XSS vectors within Cargo field definitions.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from wiki page loads; these would appear in browser-side network logs or proxy logs rather than server logs.
• User Activity: Unusual account activity (e.g., unexpected edits, permission changes, or password resets) on accounts that recently visited affected Cargo pages, potentially indicating session hijacking (Phabricator).

The primary remediation is to upgrade the MediaWiki Cargo Extension to version 3.8.7 or later, which includes the fix applied in Gerrit change 1237973 (Gerrit, GitHub Advisory). If immediate patching is not feasible, administrators should consider temporarily disabling the Cargo Extension until the update can be applied. Additionally, deploying Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in wiki content can serve as a compensating control.

A technical write-up was published by Infinit Security detailing the stored XSS attack path through Cargo list fields on ?action=pagevalues and Special:CargoTables pages (Infinit Security). The vulnerability was also noted in the Yocto Project security mailing list, indicating awareness in the broader open-source community (Yocto Security List). No major vendor statements or widespread social media discussion beyond standard CVE tracking aggregators have been observed.