CVE-2026-39839 Mediawiki CVE debrief

Who should care

Users of Mediawiki - Cargo Extension before version 3.8.7 should apply patches to prevent Stored XSS attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and validate affected scope, severity, and vendor guidance.

Technical summary

The Mediawiki - Cargo Extension is vulnerable to Stored XSS due to improper neutralization of Script-Related HTML tags in a web page (basic XSS). This issue affects Mediawiki - Cargo Extension before version 3.8.7. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity. Users should apply patches or upgrades to prevent Stored XSS attacks. Affected product deployments should be reviewed and verified by operators, platform administrators, vulnerability management teams, and security teams. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The CVE record and NVD detail provide evidence of the vulnerability and its impact, but further analysis is needed to fully understand the scope of the vulnerability.

Defensive priority

Medium priority given the CVSS score of 6.3 and the potential for Stored XSS attacks.

Recommended defensive actions

• Apply patches from https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957 and https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237977
• Upgrade to Mediawiki - Cargo Extension version 3.8.7 or later
• Monitor for suspicious activity related to Stored XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide evidence of the vulnerability and its impact. However, further analysis is needed to fully understand the scope of the vulnerability. The vulnerability affects Mediawiki - Cargo Extension before version 3.8.7, and users should verify their deployments and apply patches or upgrades as necessary. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity. The affected product is Mediawiki - Cargo Extension, and the vulnerability class is Stored XSS.

Official resources