CVE-2025-62671: Mediawiki Cargo Extension Vulnerable to Stored Cross-site Scripting
Summary
CVE-2025-62671: Cargo Mediawiki Extension vulnerable to Cross-site Scripting. Affects mediawiki/cargo versions < 3.8.3. Fixed in 3.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Mediawiki Cargo Extension is a powerful tool that enhances the Mediawiki platform by allowing users to create and manage structured data within their wikis. It enables the storage and retrieval of data in a tabular format, facilitating advanced querying and reporting capabilities. However, prior to version 3.8.3, the extension was susceptible to a Stored Cross-site Scripting (XSS) vulnerability, which could be exploited by attackers to inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to store malicious scripts that can be executed when other users view the affected pages. This can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware. The issue specifically affects versions of the Cargo Extension before 3.8.3, making it critical for users to update to the latest version to mitigate the risk.
How To Fix
Minimum fixed version
3.8.3
This is the first release that contains the fix.
composer require mediawiki/cargo:3.8.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the affected features of the Cargo Extension until the update can be applied. Additionally, implementing input validation and sanitization on user inputs can help mitigate the risk of XSS attacks.
Conclusion
The Mediawiki Cargo Extension has a critical vulnerability (CVE-2025-62671) that allows for Stored Cross-site Scripting. Users are strongly advised to update to version 3.8.3 or later to protect their installations. Utilizing tools like Vulert can help monitor and identify vulnerabilities in real-time.
See every vulnerability recorded for mediawiki/cargo →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check if your Mediawiki installation is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and the spread of malware among users of the affected Mediawiki instance.
Yes, implementing input validation, output encoding, and using security libraries can help prevent XSS attacks.
If you cannot update immediately, consider restricting access to the affected features and implementing input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/cargo.
