CVE-2026-39837

CVE-2026-39837 is a stored cross-site scripting (XSS) vulnerability in the WikiWorks Mediawiki Cargo Extension that results from improper neutralization of script-related HTML tags. The vulnerability affects versions of the Cargo Extension prior to 3.8.7, allowing attackers to inject malicious scripts into web pages that persist in the application's database. The vulnerability carries a CVSS score of 5.4 (Medium), requiring network access and low attack complexity but necessitating user interaction and valid credentials. While the attack has limited scope impact, it enables compromised confidentiality and integrity of affected systems. The EPSS score of 0.00028 indicates this vulnerability has extremely low probability of exploitation in the wild compared to other disclosed CVEs. This vulnerability is not currently being actively exploited in the wild, as indicated by its absence from the Known Exploited Vulnerabilities (KEV) catalog and inactive status on threat intelligence hot lists. No public exploit code appears to be readily available, and community attention remains minimal. Organizations running Cargo Extension versions prior to 3.8.7 should prioritize patching to mitigate stored XSS risks, particularly in environments with untrusted content contributors.