bombobombone/cve-2026-96876Proof-of-concept and patch notes for CVE-2026-96876, a reflected XSS in MediaWiki Cargo export error messages, with a script to verify unescaped exception output.
Reporter: Marco Paciaroni (BomboBombone).
CargoExport emitted exception messages without HTML escaping. Some exceptions included untrusted field-alias text, allowing error output to become executable markup.
The CVE record identifies Cargo through 3.9.4 as affected.
The original report established anonymous access to the vulnerable error path without a saved page or existing Cargo data. A victim opening a crafted request could run script in the wiki origin with their available permissions.
The original report records browser execution from the local HTML error response. The validation request did not modify wiki state, and an ordinary control did not create an executable element.
The upstream change HTML-escapes exception messages before printing them in the export response.
python poc.py https://wiki.example
The script requests the affected export error path with a harmless DOM marker and reports whether the marker is reflected as a script element.