CVE-2026-58519: Stored XSS through Cargo's map format
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	SomeRandomDeveloper
	Apr 22 2026, 1:00 PM

Project Tags

Referenced Files

	F77281182: T424140.patch
	Apr 22 2026, 1:06 PM

	F77280326: image.png
	Apr 22 2026, 1:00 PM

Subscribers

Description

It's possible to perform stored XSS through wikitext by abusing Cargo's map format.

Reproduction steps

Create Template:XSS with {{#cargo_declare:_table=XSS|lat=Lat|lon=Lon}}
Create the table for Template:XSS
Create another page with the following contents:

== XSS ==

<div class="mapCanvas olMap" style="height: 400px; width: 100%;" id="mapCanvas1">
<span class="cargoMapData" style="display: none" data-mapping-service="OpenLayers">[{"name":1,"title":"<img src=x onerror=alert(1)>","lat":1,"lon":2,"otherValues":{}}]</span>
</div>

== Real Map ==

{{#cargo_store:_table=XSS|lat=1|lon=1}}
{{#cargo_query:
|tables=XSS
|fields=lat,lon
|format=map
}}

Click on the marker in the first map

Cause

Cargo stores the JSON for the map inside a <span>, which can be replicated through wikitext.
In addition to that, the existing span can also be modified using the language converter.

Additional information

MW: 1.46.0-alpha (4dc13a1)
Cargo: 3.9 (ee74846)

Details

Risk Rating: Medium
Author Affiliation: Wikimedia Communities

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	SECURITY: Use a reserved data attribute to store map data	SomeRandomDeveloper	mediawiki/extensions/Cargo	master	+14 -8

Customize query in gerrit

Related Objects

Mentioned In: T421273: Write and send supplementary release announcement for extensions and skins with security patches (1.43.9/1.44.6/1.45.4)
Mentioned Here: rECRGee74846e7beb: Localisation updates from https://translatewiki.net.
rMW4dc13a15c3fe: Media: Improve $wgThumbnailBuckets documentation and examples

Event Timeline

SomeRandomDeveloper created this task.Apr 22 2026, 1:00 PM

Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptApr 22 2026, 1:00 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

SomeRandomDeveloper claimed this task.Apr 22 2026, 1:01 PM

SomeRandomDeveloper added projects: MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze.

SomeRandomDeveloper added a subscriber: Yaron_Koren.

T424140.patch3 KBDownload

This patch stores the map data in the data-mw-cargo-map-data attribute instead of the element's contents, and ignores all .cargoMapData elements that don't have the attribute. This way, users cannot create fake map data elements, and as the data is in the attribute, it won't be modified by the language converter.

SomeRandomDeveloper mentioned this in T421273: Write and send supplementary release announcement for extensions and skins with security patches (1.43.9/1.44.6/1.45.4).Apr 22 2026, 1:06 PM

SomeRandomDeveloper added a subscriber: gerritbot.

In T424140#11848925, @SomeRandomDeveloper wrote:

T424140.patch3 KBDownload

Can just go through gerrit and have Yaron review it there.

In T424140#11849017, @sbassett wrote:

In T424140#11848925, @SomeRandomDeveloper wrote:

T424140.patch3 KBDownload

Can just go through gerrit and have Yaron review it there.

There are other wiki / wiki farm operators using Cargo, which @Yaron_Koren usually adds to the task to give them time to patch the vulnerability. But yes, after that. I can upload it to gerrit

@SomeRandomDeveloper - thank you for finding this issue, as well as the fix for it. I have added some subscribers to this task.

sbassett edited projects, added: SecTeam-Processed; removed: Product Safety and Integrity, Security-Team.Apr 27 2026, 4:25 PM

Change #1277612 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/Cargo@master] SECURITY: Use a reserved data attribute to store map data

https://gerrit.wikimedia.org/r/1277612

Change #1277612 merged by jenkins-bot:

[mediawiki/extensions/Cargo@master] SECURITY: Use a reserved data attribute to store map data

https://gerrit.wikimedia.org/r/1277612

SomeRandomDeveloper closed this task as Resolved.Apr 28 2026, 5:57 PM

SomeRandomDeveloper removed a project: Patch-For-Review.Apr 28 2026, 6:10 PM

sbassett triaged this task as Medium priority.May 5 2026, 6:13 PM

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Medium.

Mstyles renamed this task from Stored XSS through Cargo's map format to CVE-2026-58519: Stored XSS through Cargo's map format.Jul 1 2026, 3:59 AM

CVE-2026-58519: Stored XSS through Cargo's map formatClosed, ResolvedPublicSecurityActions