Cargo stored Drilldown tab names declared in a template, then emitted each name as raw HTML. An editor with ordinary template-editing access could store an event-bearing element in a tab name; anyone opening the affected public Drilldown page would trigger it.
Technical details
Cargo parsed _drilldownTabs metadata without applying the strict identifier checks used for other Cargo names. The value was serialized with the page’s Cargo metadata and later passed to Html::rawElement() as the body of a tab link.
Cargo’s default permissions allow anonymous users to run public Cargo queries. The attacker needed permission to edit a Cargo-declaring template, but the victim did not need an account. Cargo versions through 3.9.4 were affected.
Reproduction
- Edit a Cargo-declaring template using an ordinary registered account.
- Add an event-bearing SVG element as a Drilldown tab name.
- Visit the public
Special:Drilldown page for that table without signing in.
- The browser receives the element as markup and runs its event handler.
Impact
This was stored cross-site scripting. A malicious template editor could run JavaScript in the wiki origin for anonymous visitors and privileged users who opened the affected Drilldown page.
References
Cargo stored Drilldown tab names declared in a template, then emitted each name as raw HTML. An editor with ordinary template-editing access could store an event-bearing element in a tab name; anyone opening the affected public Drilldown page would trigger it.
## Technical details
Cargo parsed `_drilldownTabs` metadata without applying the strict identifier checks used for other Cargo names. The value was serialized with the page's Cargo metadata and later passed to `Html::rawElement()` as the body of a tab link.
Cargo's default permissions allow anonymous users to run public Cargo queries. The attacker needed permission to edit a Cargo-declaring template, but the victim did not need an account. Cargo versions through 3.9.4 were affected.
## Reproduction
1. Edit a Cargo-declaring template using an ordinary registered account.
2. Add an event-bearing SVG element as a Drilldown tab name.
3. Visit the public `Special:Drilldown` page for that table without signing in.
4. The browser receives the element as markup and runs its event handler.
## Impact
This was stored cross-site scripting. A malicious template editor could run JavaScript in the wiki origin for anonymous visitors and privileged users who opened the affected Drilldown page.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96874)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96874)
- [Cargo fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328631)
- [Research index](/about/)
BomboBombone.exe