MEDIUM

GHSA-gr6v-3pmp-996p

Cargo Mediawiki Extension vulnerable to Cross-site Scripting

Quick fix

GHSA-gr6v-3pmp-996p — mediawiki/cargo: upgrade to the fixed version with the command below.

composer require mediawiki/cargo:^3.8.3

Details

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension befor 3.8.3.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/cargo

Introduced in: 0Fixed in: 3.8.3

Fixcomposer require mediawiki/cargo:^3.8.3

References

https://nvd.nist.gov/vuln/detail/CVE-2025-62671[ADVISORY]
https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e50915626c0d9a7b222dabc94ddfcb516caf557d[WEB]
https://gerrit.wikimedia.org/r/1179707[WEB]
https://github.com/wikimedia/mediawiki-extensions-Cargo[PACKAGE]
https://phabricator.wikimedia.org/T402147[WEB]