Cargo Mediawiki Extension vulnerable to Cross-site Scripting

中危 6.9CVE-2025-62671 · GHSA-gr6v-3pmp-996p · Published 18/10/2025 · updated 09/10/2026

要点

CVE-2025-62671 是影响 mediawiki/cargo 的中危 (CVSS 6.9)漏洞。
未来 30 天内被利用的概率（EPSS）：0.51%，高于 43.5% 的漏洞。
修复：升级到 3.8.3 或更高版本。

Package	Affected versions	Patched versions
mediawiki/cargo Packagist	`< 3.8.3`	`3.8.3`

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension befor 3.8.3.

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.

References

nvd.nist.gov/vuln/detail/CVE-2025-62671 · ADVISORY
wikimedia/mediawiki-extensions-Cargo commit e509156 · WEB
gerrit.wikimedia.org/r/1179707 · WEB
wikimedia/mediawiki-extensions-Cargo · PACKAGE
phabricator.wikimedia.org/T402147 · WEB

mediawiki/cargo 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mediawiki/cargo

Packagist

< 3.8.3

3.8.3

Description

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.

mediawiki/cargo 的其他漏洞

查看全部 →