MEDIUM6.1

GHSA-jqvm-9xm2-gc38

Mediawiki Cargo extension vulnerable to Cross-site Scripting

Quick fix

GHSA-jqvm-9xm2-gc38 — mediawiki/cargo: upgrade to the fixed version with the command below.

composer require mediawiki/cargo:^3.6.1

Details

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/cargo

Introduced in: 0Fixed in: 3.6.1

Fixcomposer require mediawiki/cargo:^3.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2024-47847[ADVISORY]
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804[WEB]
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806[WEB]
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827[WEB]
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831[WEB]
https://github.com/wikimedia/mediawiki-extensions-Cargo[PACKAGE]
https://phabricator.wikimedia.org/T368628[WEB]
https://phabricator.wikimedia.org/T372211[WEB]