Cargo’s public Drilldown page copied the _search[] request value into its applied-filter breadcrumb without HTML escaping. When full-text page indexing was enabled, an attacker could send a crafted link that executed JavaScript when another user opened it.
Technical details
The Drilldown page took the first _search[] value and added it to a breadcrumb span as a string. It did not escape the value for HTML text context before emitting the response.
The affected wiki needed Cargo full-text indexing enabled in $wgCargoPageDataColumns, a public table in the Drilldown interface, and a search term that matched page text in that table. Cargo’s default permissions allow public Cargo queries. Versions through 3.9.4 were affected.
Reproduction
- Identify a public Drilldown table with full-text page indexing enabled and a term that matches one of its pages.
- Open its
Special:Drilldown URL with that term in _search[], followed by a harmless SVG event-handler marker.
- The response includes the SVG in the applied-filter breadcrumb.
- A browser creates the SVG element and sets the marker.
Impact
This was reflected cross-site scripting. A victim who followed the crafted link ran JavaScript in the wiki origin with their session privileges.
References
Cargo's public Drilldown page copied the `_search[]` request value into its applied-filter breadcrumb without HTML escaping. When full-text page indexing was enabled, an attacker could send a crafted link that executed JavaScript when another user opened it.
## Technical details
The Drilldown page took the first `_search[]` value and added it to a breadcrumb span as a string. It did not escape the value for HTML text context before emitting the response.
The affected wiki needed Cargo full-text indexing enabled in `$wgCargoPageDataColumns`, a public table in the Drilldown interface, and a search term that matched page text in that table. Cargo's default permissions allow public Cargo queries. Versions through 3.9.4 were affected.
## Reproduction
1. Identify a public Drilldown table with full-text page indexing enabled and a term that matches one of its pages.
2. Open its `Special:Drilldown` URL with that term in `_search[]`, followed by a harmless SVG event-handler marker.
3. The response includes the SVG in the applied-filter breadcrumb.
4. A browser creates the SVG element and sets the marker.
## Impact
This was reflected cross-site scripting. A victim who followed the crafted link ran JavaScript in the wiki origin with their session privileges.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96877)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96877)
- [Cargo fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328628)
- [Research index](/about/)
BomboBombone.exe