bombobombone/cve-2026-96874Proof-of-concept and patch verification notes for CVE-2026-96874, a stored XSS in MediaWiki Cargo Drilldown tab labels rendered as raw HTML.
Reporter: Marco Paciaroni (BomboBombone).
Cargo stored Drilldown tab labels in page metadata and rendered them as raw HTML. A label controlled by a template editor could become executable markup when the Drilldown page was viewed.
The CVE record identifies Cargo through 3.9.4 as affected.
The attacker needed permission to edit a Cargo-declaring template. With public Cargo queries enabled, visitors to the affected Drilldown page could include anonymous users and privileged accounts. Script execution occurred in the wiki origin.
The original report records a template edit by an ordinary account and browser execution during an anonymous visit. Restoring an ordinary label removed the observed behavior.
The upstream change renders tab-link labels with a text-escaping HTML helper instead of accepting the label as raw HTML.
python poc.py ExistingCargoTable Name --wiki https://wiki.example
The script prints a Cargo declaration containing a harmless DOM marker and the corresponding Drilldown URL. Apply it only to a test template you are authorized to edit, then restore the original declaration.