Cargo’s Drilldown page treated the suffix of a hierarchy filter as message markup, then decoded its entities before inserting it into an HTML span. An unauthenticated visitor could send a crafted URL to make a victim’s browser execute the filter value.
Technical details
The ~within_ hierarchy-filter branch passed request data to Message::parse(). The rendered result was later passed through html_entity_decode() and inserted into the applied-filter breadcrumb as raw HTML. Ordinary filter values kept their escaping; this hierarchy path did not.
Cargo’s default runcargoqueries permission makes public Drilldown pages available to anonymous visitors. The CVE record lists Cargo through 3.9.4 as affected.
Reproduction
- Find a public Cargo table that contains a hierarchy field.
- Open its
Special:Drilldown URL with a hierarchy filter whose suffix contains an image element with a harmless event-handler marker.
- The applied-filter breadcrumb contains an actual image element instead of displaying the value as text.
- In a browser, the event handler sets the marker.
Impact
This was reflected cross-site scripting. A victim who opened the crafted URL ran JavaScript in the wiki origin with the victim’s session context.
References
Cargo's Drilldown page treated the suffix of a hierarchy filter as message markup, then decoded its entities before inserting it into an HTML span. An unauthenticated visitor could send a crafted URL to make a victim's browser execute the filter value.
## Technical details
The `~within_` hierarchy-filter branch passed request data to `Message::parse()`. The rendered result was later passed through `html_entity_decode()` and inserted into the applied-filter breadcrumb as raw HTML. Ordinary filter values kept their escaping; this hierarchy path did not.
Cargo's default `runcargoqueries` permission makes public Drilldown pages available to anonymous visitors. The CVE record lists Cargo through 3.9.4 as affected.
## Reproduction
1. Find a public Cargo table that contains a hierarchy field.
2. Open its `Special:Drilldown` URL with a hierarchy filter whose suffix contains an image element with a harmless event-handler marker.
3. The applied-filter breadcrumb contains an actual image element instead of displaying the value as text.
4. In a browser, the event handler sets the marker.
## Impact
This was reflected cross-site scripting. A victim who opened the crafted URL ran JavaScript in the wiki origin with the victim's session context.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96875)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96875)
- [Cargo fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328629)
- [Research index](/about/)
BomboBombone.exe